France opens probe into unprecedented cyberattack that heated supermarket fridges to 50C

Refrigeration is one of the least glamorous parts of a supermarket and one of the most essential. A large French hypermarket depends on hundreds of connected controllers to hold chilled and frozen goods inside narrow temperature bands, and those controllers increasingly sit on the same corporate networks that carry payment data, inventory updates and delivery scheduling. That quiet dependency turned into a national security story in October 2026, when attackers reached into the refrigeration estate of some of France's biggest food retailers and drove temperatures in fridges and freezers as high as 50 degrees Celsius (122 degrees Fahrenheit), spoiling fresh and frozen stock and, according to several accounts, starting fires inside stores.

The disruption unfolded overnight on October 11 and 12, 2026, and hit hundreds of outlets belonging to Intermarche and its parent group Les Mousquetaires, Cooperative U, Carrefour, Monoprix, E. Leclerc and others. By October 12, retailers were confirming that equipment had been heated for roughly six hours, that whole aisles of product would have to be discarded, and that the incident was unlike anything they had faced before. The Paris prosecutor's office opened an investigation into what it called a large-scale cyberattack affecting connected refrigerators in several major food retailers across France, with a mandate to identify the victims and establish the link with the damage they reported in terms of foodstuff losses and the outbreak of fires.

The political response was immediate. Prime Minister Sebastien Lecornu instructed France's national cybersecurity agency, ANSSI, to investigate, according to a person in his office who spoke to Reuters, and Paris began coordinating with European counterparts on the assumption that other countries could also be affected while also examining whether other French firms were at risk. A source close to Lecornu said ANSSI had identified a vulnerability in software supplied by the Danish company Danfoss, a major supplier of refrigeration controllers and management systems. Danfoss said it was aware of incidents in France affecting a limited number of refrigeration management systems and that the affected units were running outdated firmware.

The technical trail reaches back further than the attack itself. In August 2026, the research arm of the industrial cybersecurity firm Claroty, known as Team82, published findings on the Danfoss AK-SM 800A, a centralized system manager used to coordinate refrigeration controllers in supermarkets, cold storage facilities and warehouses. That work, combined with evidence that thousands of such devices were reachable from the public internet, reframed what had long been treated as a facilities management problem into a cyber-physical security problem with direct consequences for the food supply.

Key Facts

Reuters reported on October 12 that hackers forced the temperature of many French supermarket fridges up to 50 degrees Celsius overnight in an unprecedented cyberattack affecting several hundred stores, with fires and food losses reported. Les Mousquetaires, which owns Intermarche, said about 150 of its stores had been hit, with refrigeration units heated to 50 degrees Celsius for six hours, and that it had thrown all of the food away to avoid health risks.

Al Jazeera reported on October 13 that at least 300 shops of Intermarche or its Netto brand were targeted, along with more than 100 Cooperative U outlets. Carrefour said 80 supermarkets were affected, while Monoprix said about 5 percent of its roughly 490 stores were hit. E. Leclerc said several of its stores were targeted. France 24 reported on October 12 that up to 200 Intermarche stores and almost 100 Cooperative U locations had been affected, and that Carrefour had stressed that the vast majority of its 6,000 stores were not touched.

The financial toll is still being counted, but early estimates are large. Intermarche chief executive Thierry Cotillard told BFM TV the attack would represent losses of tens of millions of euros nationwide in a single day. CNBC reported on October 13 that Les Mousquetaires expected damages across around 180 stores to reach several million euros in losses, and that a spokesperson said the overheating of equipment produced smoke in some stores while no fires were reported by the group, which was awaiting findings from a court appointed bailiff and insurance experts for precise figures. Intermarche warned there could be issues with insurance policies that do not cover this type of in store incident.

Retailers and suppliers outside France felt the shockwave too. Ahold Delhaize, the Dutch group that owns the Albert Heijn chain, said it was experiencing a security issue within its network and had taken systems offline; its stores remained open, but its online app and delivery system were down. Felix Aime, a senior cyberthreat intelligence analyst at Sekoia, told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected.

IndustrialCyber reported on October 13 that Claroty's Team82 found numerous management interfaces for the Danfoss AK-SM 800A reachable from the public internet, with a Censys scan showing 2,765 exposed devices. After reverse engineering the firmware, researchers identified three flaws in the embedded web interface: CVE-2025-41450, a hidden code of the day authentication mechanism that could let an attacker bypass normal login; CVE-2025-41451, a command injection flaw leading to remote code execution; and CVE-2025-41452, an Nginx configuration injection issue that can trigger denial of service. Danfoss released firmware R4.3.1 to address them.

Analysis

What this really means is that the retail sector has quietly accumulated a cyber-physical attack surface that its security budgets were never designed to cover. Supermarket cybersecurity spending has traditionally followed the money, which means point of sale terminals, payment gateways and customer databases. Refrigeration controllers sit in the operational technology layer, where availability matters more than confidentiality, where devices are expected to run untouched for years, and where a remote attacker who can change a set point can destroy inventory without ever touching a cash register. Claroty chief technology officer Amir Preminger said refrigeration controllers are a prime target that often goes overlooked by security teams, and he noted that even nation state actors have targeted them.

The timeline exposes a second problem: the gap between disclosure and deployment. Claroty published its research in August 2026, and Danfoss released firmware R4.3.1 in response, yet the units caught up in the October attack were running outdated firmware. In operational technology, patching is slow by design, because controllers are embedded in live processes that cannot easily be taken offline in a warehouse or a store that trades seven days a week. The result is a predictable window in which a known, documented flaw remains exploitable across an installed base of thousands of devices, including the 2,765 exposed AK-SM 800A units that one internet scan identified.

The choice of target also carries a message. Nobody has publicly claimed responsibility, and the Paris prosecutor's investigation is at an early stage, so motive remains open. But the practical effect was to attack food preservation rather than payment, which turns a technical intrusion into a visible, physical event that consumers can see on the shelves and smell in the aisles. Cooperative U chief executive Dominique Schelcher called the targeting of equipment essential to the preservation of fresh products and the food supply of the French people extremely serious and unprecedented, and said it was unacceptable. That framing, repeated across the industry, is what turns a patch management failure into a political problem.

The commercial and legal consequences are already spreading. Intermarche has warned that some insurance policies may not cover this type of in store incident, which suggests the sector may discover that its coverage language was written for fire, flood and theft rather than for remote manipulation of a thermostat. And because the same suppliers sell refrigeration management systems across Europe, the incident has an obvious cross border dimension: Sekoia's Felix Aime named Spain, Portugal, Poland, Germany and Belgium as also affected, and Ahold Delhaize's network security issue in the Netherlands suggests the problem is not contained by national borders.

Why It Matters

Food retail is critical infrastructure in everything but name. Fresh and frozen goods move through a tightly timed chain that assumes working refrigeration at every step, and a six hour heat spike is enough to force the destruction of entire categories of stock for health and safety reasons. Les Mousquetaires said it threw all the food away at affected stores, and Intermarche told AFP that branches would have to throw away all of the products that are fresh and frozen. Multiply that across hundreds of stores and the loss is measured not only in euros but in wasted production, disrupted deliveries and the confidence of shoppers who arrive to find empty chilled cabinets.

The political class has drawn a wider conclusion. European Commissioner for Agriculture and Food Christophe Hansen said food security requires more attention at all levels because the weaponization of food has become a reality. That is an unusually blunt statement from a senior official, and it places this attack in the same bracket as assaults on energy grids and transport systems: low drama for the attacker, high visibility for the public, and immediate pressure on governments to respond.

For security teams, the lesson is that the boundary between information technology and operational technology is now the front line in retail. A compromised refrigeration controller does not need to exfiltrate a single record to cause damage. It only needs to hold a set point at 50 degrees Celsius for six hours. The French case shows how quickly that simple action can escalate into a prosecutor's investigation, a prime ministerial instruction to ANSSI, a European coordination effort and a board level argument about insurance.

Next Up

Attention now turns to the Paris prosecutor's investigation and to ANSSI's technical findings. Investigators have said they want to identify the victims and establish the link between the intrusion and the reported food losses and fires, a task that requires correlating retailer incident logs with supplier telemetry. Danfoss will face scrutiny over how quickly customers running outdated firmware can be upgraded, and retailers will have to decide whether refrigeration management systems should be isolated from corporate networks, monitored around the clock, or replaced.

The scope may also widen geographically. French authorities are coordinating with European counterparts precisely because other countries could be affected, and Sekoia's assessment already points to Spain, Portugal, Poland, Germany and Belgium. Ahold Delhaize has taken systems offline and is working through its own network security issue. The next concrete signals to watch are whether ANSSI publishes technical guidance, whether other European regulators open inquiries of their own, and whether insurers clarify what, if anything, they will pay for when a freezer is hacked rather than flooded.