Hundreds of supermarkets across France have been hit by a major cyberattack that caused refrigerators and freezers to heat up to 50 degrees Celsius, spoiling food and triggering fires, prompting a national investigation into the security of critical food supply infrastructure.
The attack, which occurred overnight between Sunday and Monday, targeted connected refrigeration systems at several major supermarket chains, including Intermarché, Carrefour, Monoprix and Coopérative U.
According to Reuters, the Paris prosecutor’s office described the incident as a “large-scale” attack affecting connected refrigerators at several major food retailers. Authorities said the reported damage included food losses and fires.
France’s Prime Minister Sébastien Lecornu instructed the country’s National Cybersecurity Agency (ANSSI) to investigate the incident, while authorities began coordinating with European counterparts amid concerns that other countries could also be affected.
Les Mousquetaires, the parent company of Intermarché, said refrigeration systems at around 150 of its stores had been affected, with temperatures rising to 50 degrees Celsius for approximately six hours. The company said all affected food had been discarded to eliminate potential health risks.
Carrefour reported that 80 of its supermarkets had been hit, while Monoprix said about five per cent of its approximately 490 stores in France were affected. Coopérative U also confirmed that its outlets had been targeted.
Intermarché chief executive Thierry Cotillard described the incident as unprecedented, estimating that the attack could cause losses amounting to “tens of millions of euros nationwide in a single day,” Reuters reported.
Dominique Schelcher, chief executive of Coopérative U, condemned the targeting of refrigeration equipment, saying: “Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented.”
Investigators are examining vulnerabilities in refrigeration management systems supplied by Danish engineering company Danfoss.
The systems allow supermarkets to control multiple refrigerators and freezers through central panels, some of which can be accessed remotely over the internet for maintenance.
Danfoss acknowledged that it was aware of incidents affecting a limited number of refrigeration management systems in France. The company said the affected units were running outdated firmware and reiterated that it had advised customers to install supported updates and migrate older systems to newer solutions.
French authorities have warned that exposing refrigeration management interfaces directly to the internet is contrary to cybersecurity best practices. Investigators have not publicly established how the attackers gained access to the systems or identified those responsible.
The incident has also raised concerns about the potential consequences of cyberattacks on food security, particularly as supermarkets increasingly depend on digitally connected equipment to preserve perishable goods.
The European Union’s food and agriculture commissioner, Christophe Hansen, condemned the attack, warning that food security required greater attention at every level.
Reuters also reported that cybersecurity analyst Félix Aimé said Spain, Portugal, Poland, Germany and Belgium had been affected by related incidents, although the full extent of the international impact remained unclear.
Separately, Dutch supermarket operator Ahold Delhaize said it was dealing with a security issue within its network and had taken some systems offline as a precaution. The company said there was no reason to link its incident to the attacks in France.
The French investigation is expected to establish the extent of the damage, identify those responsible and determine how vulnerabilities in supermarket refrigeration systems were exploited.
The attack has underscored the growing risks facing food retailers as cybercriminals increasingly target the digital systems underpinning essential services and supply chains.
