Unprecedented Cyberattack Disrupts Hundreds of Supermarkets in France
Hundreds of supermarkets across France have been struck by what retail executives and authorities termed an unprecedented cyberattack targeting connected refrigeration infrastructure. Major grocery chains including Intermarche, Cooperative U, Carrefour, Monoprix, and E. Leclerc confirmed on Monday, October 13, 2026, that hackers remotely manipulated store temperature controls, driving fridges and freezers as high as 50 degrees Celsius (122 Fahrenheit) for several hours. According to reporting by Al Jazeera, the malicious action forced the total destruction of massive fresh and frozen food inventories and triggered localized fires in multiple branches.
The Paris prosecutor’s office confirmed that a large-scale criminal probe has been opened into the incident, focusing on unauthorized access to connected cooling rooms across several major food retail groups. Industry estimates and retailer disclosures outline widespread reach: at least 300 shops operating under Intermarche or its Netto brand were targeted, alongside more than 100 Cooperative U outlets, approximately 80 Carrefour locations, and roughly 5 percent of Monoprix’s 490 stores. E. Leclerc also acknowledged that several of its branches suffered direct operational disruptions.
Danfoss Software Vulnerability and Firmware Risks
Investigators and technical specialists have traced the vector to remote control panels used by maintenance providers to manage store refrigeration over the internet. A source close to French Prime Minister Sebastien Lecornu told Al Jazeera that France’s National Cybersecurity Agency (ANSSI) has identified a vulnerability in software supplied by Danish manufacturer Danfoss. The agency has initiated a formal investigation while coordinating with European counterparts to assess potential spillover effects in neighboring jurisdictions.
In response, Danfoss acknowledged being aware of incidents affecting a limited number of refrigeration management systems in France. The manufacturer stated that the affected units were running outdated firmware and emphasized that it has long advised customers to keep supported systems updated and migrate legacy hardware to current-generation solutions. The incident follows cybersecurity research published in August by Claroty, which detailed authentication bypass vulnerabilities within similar Danfoss control architectures.
Economic Losses and Broader Supply Chain Implications
While an exhaustive industry-wide financial accounting remains pending, Intermarche CEO Thierry Cotillard told BFM TV that single-day losses would amount to tens of millions of euros nationwide. Cooperative U CEO Dominique Schelcher condemned the incident in a public statement on X, writing that targeting infrastructure essential to the preservation of fresh products and the food supply of the French public is extremely serious, unprecedented, and unacceptable.
Cybersecurity analysts have warned that the attack serves as a stark warning regarding industrial Internet of Things security. Speaking to Al Jazeera, security specialist Steven Lachance noted that live, internet-connected infrastructure remains vulnerable to remote manipulation, emphasizing that international cooperation is vital to prevent similar disruptions from extending to critical domains such as energy grids or hospitals. Meanwhile, European Union officials, including EU agriculture commissioner Christophe Hansen, echoed those concerns, stating that the exploitation of food supply chains has become an urgent operational reality.
The integration of advanced remote monitoring systems has revolutionized retail logistics by allowing centralized tracking of cold chains across extensive store networks. However, this architectural connectivity inherently expands the digital attack surface, making legacy control units prime targets for malicious actors seeking widespread physical disruption. Security researchers point out that while modern operational technology deployments often incorporate robust authentication and encryption protocols, thousands of older installations continue to operate with default credentials, unpatched firmware, or exposed web management interfaces. This systemic vulnerability allows unauthorized external entities to execute administrative commands, override local safety tolerances, and manipulate system parameters without ever setting foot on company premises.
French authorities are continuing to examine the exact access pathways utilized during the offensive, analyzing firewall logs, maintenance contractor access credentials, and network telemetry data. As investigators trace the digital footprints left across multiple retail enterprise networks, cybersecurity firms have flagged similar systemic risks in other European nations. The cross-border dimension of the investigation underscores the urgent requirement for unified regulatory standards governing industrial Internet of Things devices, particularly those embedded within critical supply chains where digital compromises instantly translate into tangible public safety hazards and severe material losses.