French prosecutors have opened a criminal investigation into a cyberattack that drove supermarket refrigerators and freezers to 50°C overnight, spoiling food and triggering fires at stores run by five of the country’s best-known retail chains. The Paris prosecutor’s office confirmed on October 12, 2026 that it is probing a “large-scale cyberattack affecting the refrigerators of several major food retail chains across France,” a case that investigators say link a wave of discarded inventory and fires at supermarket locations nationwide.
The French supermarket cyberattack has already forced retailers to throw out fresh and frozen stock across hundreds of locations, and it has reopened a long-running debate about how exposed industrial refrigeration and building-management systems are to remote attackers. Here is what has been confirmed, what remains unknown, and what the incident could mean for retailers and cold-chain operators well beyond France.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened: Fridges Forced to 50°C Overnight
According to CBS News, hackers remotely manipulated refrigeration controls at supermarkets across France, pushing internal temperatures in affected units up to 50°C (122°F), a level that renders stored meat, dairy, and frozen goods unsafe within hours. The Paris prosecutor’s office said the reported damage included both food losses and fires, and that the investigation would work to identify victims and establish the link between the attack, the spoiled inventory, and the fires that broke out at some sites.
No casualties have been tied to the fires. The scale of the French supermarket cyberattack, however, is unusual: it was not a single store or a single chain, but a coordinated hit that touched refrigeration equipment at five separate retail brands in the same window of time, according to Yahoo News.
Timeline: How the Overnight Attack Unfolded
Les Mousquetaires, the parent company of IntermarchÃĐ and Netto, told reporters that refrigeration units at approximately 150 of its stores experienced temperatures as high as 50°C for six hours overnight. That six-hour window lines up with reporting across multiple outlets describing a single overnight event rather than a slow-building or multi-day campaign. A spokesperson for the group said food at the affected branches had to be discarded entirely to eliminate any health risk, rather than spot-checked or partially saved.
The Irish Times reported that the pattern was consistent across the affected chains: refrigeration and freezer units spiking well past any safe threshold during overnight hours, when stores are typically unstaffed and automated building-management systems are left to run with minimal human oversight. That timing is itself notable. Overnight hours are precisely when an attacker who has gained remote access to a retailer’s refrigeration network would have the most room to operate undetected before morning staff discover the damage.
Which Chains Were Hit: IntermarchÃĐ, Netto, Carrefour, Monoprix, CoopÃĐrative U
Five retail brands have been confirmed as affected: IntermarchÃĐ, Netto, CoopÃĐrative U, Carrefour, and Monoprix. A CBS News report cited at least 300 shops as targeted across the group, while Les Mousquetaires itself put the IntermarchÃĐ and Netto figure at approximately 150 stores. CoopÃĐrative U reported almost 100 outlets affected. Carrefour, which operates roughly 6,000 stores nationwide, confirmed 80 of its supermarkets were hit. Monoprix said the attack touched 5% of its store network. E.Leclerc and other retailers were also reported as affected, and chain-by-chain totals remain inconsistent across reports: on October 13, 2026, AP reported roughly 700 of France’s 10,000 supermarkets were hit, while The New York Times reported 400+ French supermarkets were affected and Le Monde reported about 300 IntermarchÃĐ-group stores were hit. Store totals are best read as a range rather than one definitive number.
The spread across five competing chains in a single incident is what has drawn the most attention from security researchers watching the French supermarket cyberattack unfold. It suggests either a shared vendor, a shared refrigeration-management platform, or a shared category of vulnerable equipment used across multiple retail groups, rather than a breach specific to one company’s internal network.
Retailer Impact at a Glance
| Retail Chain | Stores Reported Affected | Reported Network Size | Confirmed Outcome |
|---|---|---|---|
| IntermarchÃĐ / Netto | ~150 (per Les Mousquetaires); up to 300 per CBS report | Not disclosed | Refrigeration held at 50°C for six hours overnight; food discarded |
| CoopÃĐrative U | Over 100 outlets | Not disclosed | Affected branches reported food losses |
| Carrefour | 80 supermarkets | ~6,000 stores | Fresh and frozen stock discarded at affected locations |
| Monoprix | 5% of stores | ~490 stores | Food discarded as a precaution |
Based on Carrefour’s own figures, the 80 affected supermarkets represent roughly 1.3% of its total store count, a small share of its overall network but still a meaningful number of individual locations dealing with spoiled inventory on the same night.
The Scale of the Damage: Food Losses and Fires
IntermarchÃĐ told AFP, in comments relayed by the MKFM report, that branches affected by the attack would have to “throw away all of the products” stored in the compromised units. That is a far more severe outcome than a typical refrigeration fault, which usually affects a single unit or a single store. Here, entire inventories at each affected location were treated as unsalvageable.
The Paris prosecutor’s office specifically cited fires as part of the reported damage alongside the food losses, and said the investigation would work to establish the causal link between the cyberattack, the spoiled inventory, and the fires. That phrasing matters: investigators have not yet confirmed that every fire reported in connection with the incident was directly caused by the cyberattack, only that establishing that link is part of the ongoing probe. Reports say overheating caused smoke at some Les Mousquetaires stores, but the company stated that no fires had been reported in its affected stores.
Why Supermarket Refrigeration Is an Attractive Cyberattack Target
Refrigeration systems in large retail chains are rarely simple thermostats. They typically sit on networked building-management platforms that control compressors, defrost cycles, and temperature alarms across dozens or hundreds of stores from a central dashboard, often managed by a third-party vendor rather than the retailer’s own IT team. That centralization is efficient for day-to-day operations, but it also means a single point of compromise can potentially reach refrigeration hardware at many locations simultaneously, which is consistent with the multi-chain spread seen in this incident.
This is not the first time attackers have targeted the operational technology, or OT, layer that sits behind consumer-facing retail and infrastructure. Ransomware crews have increasingly shifted from pure data-theft extortion toward disrupting physical operations, a trend documented in recent incidents such as the Warlock ransomware campaign that hit four separate sectors through a SharePoint vulnerability. Disruption of physical processes, whether a pipeline, a hospital system, or a supermarket’s cold chain, tends to generate more immediate pressure on victims than a quiet data breach.
The Industrial IoT Security Gap Behind the Attack
French investigators have not disclosed the specific vulnerability or access method the attackers used, and that detail remains one of the most important unanswered questions in this case. What is clear from the pattern of the incident is that it fits a broader category of weakness security researchers have flagged for years: industrial and building-management systems that were never designed with internet-facing remote access in mind, but have been connected to networks anyway for the sake of centralized monitoring and vendor maintenance.
Third-party vendor access is often the weak link in these setups. A similar dynamic played out in the EY breach, where investigators found an 85-day gap between vendor compromise and detection. Retailers managing cold-chain equipment across hundreds of stores typically rely on a refrigeration-equipment manufacturer or a facilities-management contractor to maintain remote access for diagnostics and firmware updates, and any compromise of that vendor’s credentials or software can cascade across every connected client.
Which Danfoss Controllers Were Involved
Reporting identifies Danish manufacturer Danfoss as the supplier of the internet-connected refrigeration-control systems targeted in the attack. The reported affected controller families were AK-SM800 and AK-SC355. Public reporting named the AK-SM 800 and AK-SC 355 as the principal affected legacy controllers, and some AK-SM 800A units were also reportedly involved. The AK-SM 800 was reported as formally end-of-life in 2021 and the AK-SC 355 as phased out in 2016; both were described as no longer receiving software or security updates. Danfoss’s newest announced controller is the AK-EC Lite, the first in its new ACE (Advanced Control Edge) family, announced on October 5, 2026, with pre-orders scheduled to begin in November 2026 and initial deliveries from January 2027.
Danfoss said it was working with customers on firmware updates where available, stronger network protections, and removal of direct internet exposure. Claroty’s Team82 had publicly reported vulnerabilities affecting the Danfoss AK-SM 800A on August 9, 2026, including authentication-bypass and command-execution issues, and reporting states that Danfoss released AK-SM 800A firmware R4.3.1 to mitigate the disclosed flaws. The affected systems were reportedly running outdated firmware or had reached end of life and no longer received security updates, which means that owning a controller from a named family says little on its own about whether it can still be patched.
France’s national cybersecurity authority warned on October 13, 2026 that the attack was likely still ongoing. It recommended reconnecting refrigeration equipment only through protected networks, applying firmware updates, and changing passwords. For operators, the practical first step is to identify which controller models sit on their networks, check whether each one still receives updates, and keep it off the open internet until that is settled.
Market Impact: Consumer Trust and Retailer Costs
The immediate financial hit from the French supermarket cyberattack falls into two buckets: the direct cost of discarded inventory across hundreds of stores, and the harder-to-quantify cost of consumer confidence. Food retailers operate on thin margins and depend heavily on customers trusting that refrigerated and frozen goods on shelves are safe. A cyberattack that is reported nationally as having spoiled food at well-known chains creates a reputational exposure that outlasts the immediate cleanup.
No retailer involved has disclosed a confirmed nationwide financial loss total tied to the incident, although OCCRP reported on October 13, 2026 that Mousquetaires losses reached millions of euros, Al Jazeera reported projected nationwide losses of tens of millions of euros, and BBC reported in October 2026 that two Alsace supermarkets lost âŽ270,000. Insurance underwriters covering retail and critical-infrastructure cyber risk have been raising premiums for operational-technology exposure for several years, and incidents like this one, where the damage spans five chains and includes physical fire damage rather than just data loss, tend to accelerate that repricing.
Historical Context: Critical Infrastructure Keeps Getting Hit
Attacks that cross from the digital world into physical consequences are not new, even if this particular combination, refrigeration, food safety, and fire, is unusual. The 2021 Colonial Pipeline ransomware attack shut down fuel distribution across the US Southeast for several days. The same year, an attacker briefly accessed a water-treatment facility in Oldsmar, Florida, and attempted to alter chemical dosing before an operator caught the change and reversed it. Retail has its own long history of large-scale breaches, most famously the 2013 Target payment-card breach that exposed tens of millions of customer records, though that incident targeted payment data rather than physical equipment.
| Incident | Year | Sector | Nature of Impact |
|---|---|---|---|
| Target payment-card breach | 2013 | Retail payments | Tens of millions of customer card records exposed |
| Oldsmar water-treatment hack | 2021 | Municipal water system | Remote attempt to alter chemical dosing; caught before harm occurred |
| Colonial Pipeline ransomware | 2021 | Energy / fuel distribution | Multi-day disruption to fuel supply across the US Southeast |
| French supermarket refrigeration attack | 2026 | Retail cold chain | Refrigeration forced to 50°C at hundreds of stores across five chains; food losses and fires reported |
What distinguishes the 2026 French supermarket cyberattack from most of these earlier cases is the breadth of simultaneous impact across competing companies. Colonial Pipeline and Oldsmar were single-operator incidents. This one touched five separate retail groups in the same overnight window, a pattern more often associated with a shared software or hardware dependency than a targeted attack on one company’s defenses.
What’s Still Unknown: Identity, Motive, and Method
French authorities have not named a suspect, a hacking group, or a nationality tied to the attack, and no motive has been confirmed. No ransom demand, attacker claim, or public attribution has been confirmed in reporting from October 12 through October 22, 2026, so it is not yet known whether this was financially motivated extortion, a demonstration of capability, or something else entirely. The precise exploit mechanism, whether it involved stolen vendor credentials, a software vulnerability in a shared refrigeration-management platform, or direct access to store networks, also remains unknown.
Reporting identifies Danish manufacturer Danfoss as the supplier of the internet-connected refrigeration-control systems targeted in the attack, but a reported Danfoss software vulnerability is an investigative lead, not a publicly confirmed technical root cause, and this article does not treat it as established fact. Readers should expect the picture to become clearer as the Paris prosecutor’s office investigation progresses and as affected retailers complete their own internal forensic reviews.
How French Authorities Are Responding
The Paris prosecutor’s office has opened a formal investigation, a step that in France typically brings in specialized cybercrime units to handle evidence collection across the affected retailers’ networks. Because the incident spans five separate corporate entities, investigators will likely need cooperation agreements with each retailer to compare logs, access timestamps, and any shared vendor infrastructure, a process that can take weeks or months before a clear attribution emerges.
Law-enforcement cyber investigations of this scale rarely move quickly. A useful comparison is the pace of recent cybercrime prosecutions elsewhere: the FBI’s pursuit of suspects tied to the ShinyHunters extortion group, which led to an arrest tied to a 3TB employee data theft, took months of cross-border coordination before charges were filed. A multi-retailer OT incident spanning five French companies is likely to follow a similarly extended timeline before any arrest or formal attribution is announced.
Comparing This Attack to Other Recent Retail and Infrastructure Breaches
The French supermarket cyberattack differs from most of the data breaches making headlines in 2026 in one key respect: it caused physical, immediate, irreversible damage rather than exposing records that could, in theory, be monitored or contained after the fact. Breaches like the Oracle Health breach, which exposed records for nearly 20 million people, are serious, but the victims generally retain some ability to respond after the fact, such as credit monitoring or password resets. Spoiled food and fire damage offer no equivalent remediation path.
It also echoes a pattern seen in repeated zero-day exploitation of edge devices and remote-access appliances, such as the string of Citrix NetScaler zero-days that have hit the same product line three times in a year. Attackers increasingly favor equipment that sits at the edge of a corporate network, whether that is a remote-access appliance or a refrigeration controller, because that equipment is often patched less frequently and monitored less closely than core IT systems.
5 Predictions: Where This Story Goes Next
- More retailers will quietly audit refrigeration vendors. Expect food retailers across Europe and North America to review remote-access permissions granted to cold-chain equipment vendors in the coming weeks, even without public announcements.
- Food-safety regulators will ask questions. Given the Paris prosecutor’s office explicitly tied the investigation to food losses, French food-safety authorities are likely to request documentation on how affected retailers verified product safety before restocking.
- Insurance terms for retail OT risk will tighten. Cyber-insurance underwriters covering physical-damage clauses are likely to revisit pricing for retail chains with centralized, vendor-managed refrigeration networks.
- Attribution will take time. Based on the pace of comparable multi-victim investigations, a confirmed identification of the attackers is unlikely before the investigation has run for several more weeks or months.
- Other European chains will review similar equipment. If a shared refrigeration-management platform or vendor is eventually confirmed as the common thread, expect retailers outside France using the same supplier to conduct their own precautionary reviews.
Defensive Steps: Securing Industrial Refrigeration and Building Systems
Security teams at retail chains and facilities operators do not need to wait for official attribution to start hardening the systems most exposed in this type of incident. The baseline steps below reflect standard operational-technology security guidance rather than anything specific to this still-unconfirmed attack method.
# Baseline hardening checklist for retail refrigeration / BMS networks
1. Segment refrigeration and building-management controllers from corporate IT and POS networks
2. Remove default or shared remote-admin credentials on cooling-unit controllers
3. Patch controller and gateway firmware on a fixed, tracked schedule
4. Alert on any temperature-setpoint change made outside normal business hours
5. Require MFA and a locked-down VPN for any vendor remote access session
6. Maintain an offline food-safety fallback: manual temperature logs and backup power triggersThe common thread across each of these steps is reducing how much damage a single compromised credential or vulnerable device can cause. A properly segmented network limits an attacker who gets into one store’s refrigeration controller from reaching every other store on the same vendor platform, which is precisely the multi-chain spread investigators are now trying to explain in the French supermarket cyberattack.
What This Means for the Retail Industry Going Forward
Retail chains have spent the past several years investing heavily in e-commerce security, payment tokenization, and point-of-sale hardening, largely in response to incidents like the Target breach more than a decade ago. This incident is a reminder that the operational technology running stores, refrigeration, HVAC, lighting, and building management, has not received the same level of security investment, even though a failure there can be more immediately disruptive than a data breach.
Supermarkets were reported to be restocking on October 14, 2026, but no complete, group-by-group recovery certification was reported. Additional reporting on the incident, including detail from the ongoing Paris investigation, has continued to surface through outlets such as Ynetnews, and the story is likely to keep developing as affected retailers complete damage assessments and as investigators work to confirm how the attackers gained access in the first place.
Frequently Asked Questions
What exactly happened to French supermarket fridges?
Hackers remotely forced refrigeration and freezer units at multiple French supermarket chains up to 50°C overnight, spoiling stored food and, according to the Paris prosecutor’s office, contributing to fires at some locations.
Which supermarket chains were affected?
IntermarchÃĐ, Netto, CoopÃĐrative U, Carrefour, and Monoprix have all been confirmed as affected by the cyberattack.
How many stores were hit in total?
Reported figures vary by chain: around 150 IntermarchÃĐ and Netto stores, over 100 CoopÃĐrative U outlets, 80 Carrefour supermarkets, and 5% of Monoprix’s roughly 490 stores. A CBS News report cited at least 300 shops targeted in connection with the IntermarchÃĐ and Netto group alone.
Did the cyberattack actually cause fires?
The Paris prosecutor’s office said the reported damage included food losses and fires, and that the investigation would work to establish the link between the cyberattack and those fires. That link has not yet been independently confirmed for every fire reported.
Is it safe to shop at the affected chains now?
Retailers including Les Mousquetaires said spoiled food at affected stores was discarded to eliminate health risk. None of the named retailers has indicated an ongoing food-safety concern for stores that were not directly affected.
Who is responsible for the attack?
No individual, group, or nation has been publicly identified as responsible. The Paris prosecutor’s office investigation is still working to identify victims and establish how the attack was carried out.
Could a similar attack happen to supermarkets in other countries?
Security researchers have warned for years that centralized, vendor-managed refrigeration and building-management systems carry similar risks wherever they are deployed. Until investigators confirm the specific vulnerability exploited in France, retailers elsewhere cannot rule out exposure to a comparable weakness.
What should retailers do right now?
Security teams typically start by segmenting refrigeration and building-management networks from core IT systems, auditing vendor remote-access credentials, and setting alerts for any temperature-setpoint change made outside business hours.
