The breach of refrigeration networks in hundreds of French stores represents a critical wake-up call regarding the risks of turning connected operational devices into weapons targeting the direct food security of populations.
Details of the cyberattack on French retail networks
Forced defrosting at fifty degrees and heavy commercial losses
Legacy software vulnerabilities in Danfoss controllers
European concern and warnings against using food as a weapon
Frequently asked questions
Details of the cyberattack on French retail networks
Unidentified hackers managed to take remote control of central refrigeration control systems in hundreds of hypermarkets across various French cities from the night of Sunday, October 11, to the dawn of Monday, October 12, 2026. The disruptive cyberattack raised the temperatures of refrigerators and freezers to record levels, forcing store management to immediately discard tons of fresh and frozen food, while also triggering limited fires in some affected locations.
Prominent retail chains, including E.Leclerc, Intermarché, and Système U, confirmed the incident and the damage to their facilities to Agence France-Presse. The public prosecutor’s office in Paris immediately launched a wide-ranging judicial investigation under the heading “large-scale cyberattack targeting the refrigeration infrastructure of major food retail networks in France.” This breach highlighted a new and concerning pattern of digital threats, as operational devices and vital equipment that once operated in isolation from networks have become vulnerable to external hacking and manipulation to damage facilities.
Forced defrosting at fifty degrees and heavy commercial losses
Reports from French channel BFM TV indicated that hackers successfully activated the “forced defrosting” mode of refrigeration systems in dozens of stores simultaneously. Intermarché management told Reuters that the central refrigeration units heated up to 50 degrees Celsius for about 6 continuous hours during the night, forcing them to destroy and discard all food products stored inside to protect public health. Agence France-Presse reported that the attack targeted at least 300 Intermarché and Netto stores, more than 100 Système U branches, and a number of E.Leclerc outlets.
A spokesperson for the Les Mousquetaires group noted that 180 stores were affected, while another 100 stores were disconnected from the internet in an emergency to prevent the breach from spreading. Carrefour announced that 80 of its 6,000 stores were affected, while Monoprix admitted that about 5% of its 400 branches were impacted. Reports estimated the losses of just two stores in the city of Haguenau in the Alsace region at approximately €270,000 due to spoiled goods, and Dominique Schelcher, CEO of Système U, described the attack as unprecedented and unacceptably compromising citizens’ food security.
Legacy software vulnerabilities in Danfoss controllers
Technical investigations revealed that the attack focused on electronic controllers manufactured by the renowned Danish company Danfoss. In a clarifying statement, the manufacturer explained that most of the targeted devices belong to legacy models such as AK-SM 800 and AK-SC 355, which are units that have reached the end of their operational lifecycle and no longer receive regular security and software updates.
The company added that some newer units were running outdated software packages that operators had failed to update, even though researchers from Team 82 at Claroty had uncovered security vulnerabilities in these devices back in August, at which time the company had released patches to address them. Baptiste Robert, CEO of Predicta Lab, stated that he detected 2,752 Danfoss systems exposed and directly connected to the internet, including 1,590 systems in France alone. The office of French Prime Minister Sébastien Lecornu announced that the National Cybersecurity Agency is working with European partners to address the software vulnerability.
European concern and warnings against using food as a weapon
The repercussions of the incident extended to neighboring European countries, with retail giant Ahold Delhaize reporting security issues in some of its stores in the Netherlands and Belgium. It promptly isolated its refrigeration systems and disconnected them from the internet as a precautionary measure, though it confirmed there was no conclusive evidence linking the incident to the French attacks at this time.
This cyber escalation comes one month after French President Emmanuel Macron issued strict instructions to protect critical infrastructure from potential hybrid attacks. Christophe Hansen, European Commissioner for Agriculture and Food, expressed grave concern, noting that food security requires comprehensive mobilization at the highest levels and warning that turning food supply chains into an arena for cyber conflict has become a tangible reality that cannot be taken lightly.
Frequently asked questions
Question: How did hackers carry out their attack on refrigeration devices in French stores?
Answer: Hackers exploited software vulnerabilities in legacy internet-connected controllers manufactured by Danfoss, remotely activating the forced defrosting feature to raise the temperature to 50 degrees Celsius.
Question: What is the scale of the economic damages resulting from this cyberattack?
Answer: Hundreds of stores from major retail chains were affected, tons of food and frozen meat spoiled, and the losses of just two branches in Alsace were estimated at over €270,000.
Question: What precautionary measures were taken by neighboring networks and stores in Europe?
Answer: Stores immediately disconnected hundreds of control units from the internet to prevent hacking, France launched a judicial investigation, and the cybersecurity agency coordinated with European Union countries.
