Attackers remotely altered temperature and defrost settings, forcing retailers to destroy fresh and frozen food and exposing a poorly recognised food-safety risk in connected cold-chain equipment.
FRANCE – A cyberattack targeting connected refrigeration systems affected approximately 700 supermarkets across France, pushing temperatures in some cold rooms and freezers as high as 50°C and forcing retailers to discard large quantities of food.
The attack began during the night of 11–12 October 2026 and affected stores operated by several major food retailers, including Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc.
French Finance Minister Roland Lescure said about 700 of the country’s approximately 10,000 supermarkets were affected. He said the disruption did not threaten France’s overall food supply but described the incident as a serious warning for the food sector.
France’s national cybersecurity authority subsequently warned that attacks targeting refrigeration equipment might still be taking place.
This was not simply an attack on retailer websites, payment services or customer information. The attackers interfered with equipment responsible for maintaining food at safe temperatures, turning a cybersecurity incident into a physical cold-chain failure.
Attackers manipulated defrost and temperature settings
Supermarket refrigeration systems commonly use central controllers to manage cold rooms, refrigerators and freezers across an entire store.
These systems can monitor temperatures, adjust operating schedules, manage defrost cycles, generate alarms and allow refrigeration contractors to diagnose faults remotely. Internet connectivity reduces the need for technicians to visit every location, but it can also create an entry point if management interfaces are exposed or poorly protected.
During the French incident, attackers remotely changed temperature and defrost settings. Some refrigeration units reportedly reached 50°C for approximately six hours.
At certain stores, defrost cycles were extended and alarm activation was delayed. Fires or fire-control activations were also reported at some affected locations.
Several stores temporarily closed sections or suspended operations while employees removed products and technicians restored refrigeration.
Intermarché said all food from affected equipment was discarded to protect consumers. The group’s chief executive estimated that losses across the sector could amount to tens of millions of euros in a single day.
The Paris prosecutor’s office has opened an investigation into the large-scale attack, including reported food losses and fires.
No perpetrator, motive or claim of responsibility had been publicly identified at the time of publication.
Why the food had to be discarded
The attack did not necessarily introduce a contaminant into the affected products. It compromised the environmental control used to keep them safe.
When chilled food rises above its specified storage temperature, microorganisms already present in the product may multiply. Frozen foods can thaw, lose quality and, depending on the product and length of exposure, become unsafe.
A current temperature reading is also not enough to determine whether a product remains suitable for sale. The decision depends on how warm it became, how long it remained outside its required range and the characteristics of the individual food.
European food-hygiene rules require the cold chain to be maintained. Limited periods outside temperature control are permitted only when they do not create a health risk.
In this case, retailers were dealing with deliberately altered settings, prolonged temperature excursions and potentially unreliable control records. Destroying products whose safety could no longer be demonstrated was therefore the appropriate precaution.
There is currently no evidence that food affected by the refrigeration failures was sold to consumers.
Official alert extends beyond one manufacturer
Initial reporting focused on refrigeration controllers supplied by Danish technology company Danfoss.
However, the official CERT-FR alert lists several affected controller families:
- Danfoss AK-SM
- Danfoss AK-SC
- Copeland Xweb
- Dixell Xweb
The inclusion of several controller families makes the incident broader than a single vulnerable product.
CERT-FR said it was aware of numerous compromises and warned that management interfaces for refrigeration systems should not be exposed directly to the internet.
The agency advised operators with uncompromised equipment to remove public internet access, check complete configurations, including defrost schedules, and reconnect the systems only through a secure virtual private network or another protected network.
For confirmed compromises, it recommended restoring controllers to their factory settings before reconfiguration and reconnection.
Operators were also told to install current firmware, change default passwords and activate stronger security settings.
Previously identified vulnerabilities add important context
Before the October attack, cybersecurity researchers had demonstrated weaknesses in some Danfoss AK-SM 800A refrigeration controllers.
In research published in August 2026, Claroty’s Team82 described vulnerabilities that could allow authentication bypass, remote command execution and changes to web-server configurations.
The researchers also identified thousands of management interfaces that appeared to be accessible through the public internet.
Danfoss addressed the reported vulnerabilities through firmware updates. Its current guidance says AK-SM 800A software version 4.0 and later supports HTTPS and stricter session controls. The company recommends using its Strict security mode and maintaining equipment on supported firmware.
Danfoss said most units affected in France were older products using outdated firmware or systems that had reached the end of their supported service life.
These vulnerabilities demonstrate what could be possible when controllers remain exposed and unpatched. Investigators have not confirmed that any particular published vulnerability was used in the French attacks.
Cold-chain cybersecurity cannot remain an IT-only concern
The incident exposes an important weakness in the division of responsibilities inside food businesses.
Food-safety teams may monitor temperatures and review cold-room records, while IT teams manage networks and passwords. Refrigeration contractors may separately control remote access, software configuration and firmware maintenance.
A weakness in any one of those areas can undermine the entire cold-chain system.
The same controller may operate refrigeration equipment, generate alarms and store the records used to demonstrate compliance. If it is compromised, both the physical condition of the food and the reliability of the evidence may come into question.
Food businesses using connected refrigeration should be able to establish:
- Which refrigerators, freezers and cold rooms can be accessed remotely
- Whether management interfaces are visible on the public internet
- Who is responsible for firmware updates and security patches
- Whether default passwords have been removed
- When each controller will stop receiving manufacturer support
- Whether temperature alarms operate independently of the main controller
- How temperature histories can be verified after a suspected compromise
- Who has authority to isolate equipment without losing essential monitoring
- How products will be assessed and traced after a cyber-triggered temperature excursion
- What refrigeration contractors must report when they identify a security incident
These checks are relevant not only to supermarkets. Food manufacturers, cold stores, distribution centres, restaurants, laboratories, hospitals and transport companies increasingly use remote refrigeration monitoring and maintenance systems.
For African food businesses, the incident provides a reason to examine imported and older refrigeration equipment, particularly systems maintained remotely by external contractors. Operators should not assume that a controller is protected simply because it is separate from the company’s main office network.
Separate European incidents should not be conflated
Ahold Delhaize also took systems offline following a cybersecurity incident that disrupted online orders and some deliveries at its Albert Heijn business in the Netherlands.
Dutch cybersecurity authorities said several cyber incidents had affected Europe’s food sector but that there was no reason at that stage to conclude they were connected.
Reports also indicated possible refrigeration-system compromises in Spain, Portugal, Poland, Germany and Belgium. The full extent of incidents outside France has not been confirmed by the relevant national authorities.