In the dead of night between Sunday, October 11, and Monday, October 12, a coordinated cyberattack struck hundreds of supermarkets across France, remotely hijacking connected refrigeration units and forcing major retail chains to dump tons of spoiled fresh food.
The Paris prosecutor’s office confirmed that the large-scale digital assault targeted automated cooling systems nationwide, creating a major food-supply emergency and triggering investigations by both national cybercrime units and the French government.
How Remote Hackers Weaponized French Supermarket Refrigerators
The attackers did not just shut down the cooling units; they weaponized them. According to statements from retail executives, the hackers forced retail refrigeration and cold storage systems into a prolonged defrost cycle, pushing internal temperatures up to 50 degrees Celsius for hours at a time. The operation was carefully timed. Instead of a standard one-hour defrost cycle, the intrusion extended the cycle to eight hours, deliberately delaying how quickly store alarms sounded and preventing night-shift workers from intervening before the damage was complete.
Thierry Cotillard, head of Les Mousquetaires, told broadcasters that approximately 150 Intermarché stores suffered this extreme temperature spike, forcing staff to discard entire inventories of perishable goods to eliminate any public health risk. Across the wider retail sector, at least 300 Intermarché and Netto outlets, roughly 100 Coopérative U locations, 80 Carrefour branches, 30 Monoprix stores, and multiple E.Leclerc supermarkets were hit.
The Danfoss Software Vulnerability and Warning Signs
Investigators tracing the digital breach identified a critical vulnerability in software provided by the Danish refrigeration control manufacturer Danfoss. According to a company statement, the affected stores were running outdated firmware that had reached the end of its lifecycle and no longer received software or security updates.
Security experts note that these industrial control systems—specifically the Danfoss AK-SM and AK-SC controllers—were historically isolated from the open internet. As modern supply chains integrated remote management tools, these legacy units became accessible from afar without always possessing adequate defense mechanisms against modern cyber threats. Danfoss confirmed that the critical security flaws exploited in the attack had been identified and flagged in previous manufacturer advisories dating back to 2023, with subsequent software patches issued in March and August of 2025.
National Security Response and Financial Toll on Retailers
Prime Minister Sébastien Lecornu’s cabinet instructed France’s national cybersecurity agency, ANSSI, to lead the technical investigation alongside the Paris prosecutor’s office, which formally assigned the case to the national anti-cybercrime office, OFAC. ANSSI Director-General Vincent Strubel urged operators of similar legacy equipment to immediately disconnect vulnerable controllers from the internet or implement strict network filtering.
While a definitive industry-wide financial total remains uncalculated, retail leaders warn that the losses are staggering. Thierry Cotillard estimated that the forced destruction of spoiled inventory cost Intermarché alone tens of millions of euros in a single day. Dominique Schelcher, CEO of Coopérative U, condemned the incident on social media as an unprecedented and deeply grave assault on the nation’s critical food supply chain. Retail federations are now demanding total transparency from manufacturers and installation contractors as stores face multi-day delays while central warehouses scramble to restock empty shelves.
Unresolved Questions Surrounding the National Cyberattack
As French authorities continue their forensic analysis, several key aspects of the incident remain unverified. Investigators have yet to publicly identify the specific hacker collective or state-sponsored group responsible for the intrusion, nor have they determined whether the hackers deployed ransomware or simply sought to cause widespread physical disruption. Furthermore, questions persist regarding liability and insurance coverage, with major distributors noting that standard commercial policies may not cover losses stemming from remote industrial cyber sabotage of this scale.
Worth a look
