Hackers seized Danfoss refrigeration systems overnight and forced defrost cycles that drove temperatures to 50°C; Paris prosecutors opened a cybercrime investigation as chains threw away tonnes of food.
Published 13 October 2026 · 04:31 GMT
Hundreds of French supermarkets opened on Monday morning, October 12, 2026, to a scene of waste and disorder. Managers arriving early met a wave of hot air pouring from display cases and freezers. Meat, dairy, vegetables and frozen goods sat ruined after hours at temperatures as high as 50 degrees Celsius. The cause was not a power failure or an equipment breakdown. It was a cyberattack.
Hackers had seized control of the software that regulates refrigeration temperatures and forced the systems into continuous defrost mode overnight from Sunday into Monday. What normally runs for short periods to clear frost instead ran for hours, heaters engaged, turning freezers into warming cabinets. Small fires were reported in places; a BFM TV photograph showed a freezer in an ice-cream aisle displaying 26.5 degrees.
The attack was coordinated and national in scale. It targeted refrigeration-management systems supplied by the Danish engineering firm Danfoss — and it struck several of the country's largest grocery chains at once.
The numbers are still settling, but they paint a picture of wide impact. Les Mousquetaires, owner of Intermarché and Netto, reported between 150 and 300 stores hit, with fridges heated to 50 degrees for six hours overnight into Monday; all the affected food was thrown away to avoid sanitary risk. Coopérative U said more than 100 of its supermarkets were targeted. Carrefour reported 80 of its 6,000 stores impacted. Monoprix said about 5 percent of its roughly 490 outlets saw issues. E.Leclerc said several of its stores were targeted. Estimates converge around 500 stores out of France's roughly 15,000.
The vulnerability is known. Danfoss said the affected cold units were older models whose security software could not be updated against a risk the company had already identified. The attack exploited connected refrigeration controllers — equipment with long service lives, legacy firmware and network connectivity that was added long after the hardware was built.
The institutional response was fast. The Paris prosecutor's office confirmed an investigation into a "large-scale cyber-attack affecting the refrigerators of several major food retail chains across France," citing reports of food losses and fires. Prime Minister Sebastien Lecornu ordered ANSSI, the National Cybersecurity Agency, to investigate; his office said France was coordinating with European counterparts because other countries could also be affected, and was assessing whether other French companies were at risk.
Nobody has been named. No group has claimed responsibility, and no official attribution has been published. The attackers gained access to the connected controllers and activated prolonged defrost cycles — but whether that access came through stolen credentials, an unpatched flaw, a supply-chain compromise or an insider is not public.
The full bill is also unknown. Intermarché CEO Thierry Cotillard told BFM TV the "unprecedented" attack would represent losses of "tens of millions of euros nationwide in a single day" — an industry-wide estimate, not just his chain's. Insurance, business-interruption claims and the cost of restocking will take weeks to tot up, and some losses, like the reputational hit to the cold chain, do not fit neatly on a balance sheet.
Because the cold chain is critical infrastructure wearing a retail uniform. Supermarket refrigeration is one of the load-bearing systems of modern food supply: break it for one night, in one country, and thousands of tonnes of perishable food become waste before breakfast. The attackers understood that the weakest point of a supermarket is not its shelves but its thermostats.
It matters beyond France. The same Danfoss systems run in stores across Europe — and the day the attack broke, Dutch operator Ahold Delhaize, which runs the Netherlands' largest supermarket chain Albert Heijn and has substantial operations in the United States, said it was dealing with a "security issue" in its network and had taken several systems offline to protect them. European Food Commissioner Christophe Hansen condemned the hack and said the weaponization of food had become a reality. France's political class, already consumed by budget battles, now faces a security crisis in the aisles.
First the retailers: Cotillard's "tens of millions of euros in a single day" is the opening bid, and it covers only the discarded stock. Then come the logistics — emergency restocking, refrigeration specialists dispatched overnight, stores running partial shelves for days — and then the insurers and reinsurers who underwrite business-interruption policies for retail chains. The cold-chain equipment vendors will pay in a different currency: trust. Danfoss's admission that the compromised units were known-unpatchable models shifts part of the liability conversation toward the supply chain.
The deeper question is who owns the risk of connected legacy equipment. The freezers were bought to last decades; the threat landscape changes every quarter. Somewhere between the retailer who connected the controller and the vendor who could not patch it lies a liability gap the investigation, and probably the courts, will now map.
The immediate second-order effect is copycat risk. The attack demonstrated a technique, not just an incident: prolonged defrost as a weapon against any store running the same controllers. Retailers across Europe spent Monday checking their own refrigeration management systems — Ahold Delhaize's "security issue" disclosure suggests the sweep is already under way. Any chain running older Danfoss units is now on notice.
The slower effect is regulatory. A single night in which hackers destroyed food across a country makes industrial cybersecurity a food-safety issue, and food safety is one of the EU's most jealously guarded competences. Expect mandatory patching windows, network-segmentation rules for retail operational technology, and hard questions for any vendor selling unpatchable controllers into the food chain.
Watch ANSSI's investigation and France's coordination with European counterparts — the statement from Lecornu's office that other countries "may also be affected" is the closest thing to an early warning the continent has. If the same controllers are probed in Germany, Spain or Italy in the coming days, this stops being a French incident and becomes a European one.
And watch the attribution file. The Paris prosecutor's cybercrime investigation will determine whether this was criminal extortion, vandalism, or something state-adjacent — and that determination will shape the response far beyond the supermarket aisle. For a France already strained by fiscal fears, the attack is a reminder that national security now runs through the freezer aisle.
Through the Western institutional lens, this is the nightmare scenario industrial-security specialists have warned about for a decade: legacy operational technology, connected to the internet, running unpatchable firmware, guarding something people eat. The response will be regulatory — expect the EU's machinery for critical-infrastructure protection to reach for the food chain, and expect retailers to be told that a freezer controller is now a computer that must be patched like one.
Through the Arab-media lens that carried the story first internationally, the attack reads as another front in Europe's hybrid-security anxiety — arriving the same week NATO's commander was publicly rehearsing what the alliance would do if attacked. Whether the two events are connected or merely coincident is exactly the question Europe's security establishments are now asking.
For the Global South, the story lands differently. Food spoilage on this scale, in one of the world's richest countries, is a spectacle of fragility: a food system so efficient it can be broken with a thermostat. Countries that still move food through open markets and short chains will note that resilience, in this case, belonged to the low-tech end of the spectrum — the market stall cannot be hacked.
Refrigeration units run short defrost cycles overnight to clear frost from their coils, then return to cooling. The attackers forced those cycles to run continuously for hours with the heaters engaged, turning freezers into warming cabinets. Intermarché said its fridges heated to 50°C for six hours overnight. Anything held above safe temperatures that long — meat, dairy, frozen goods — had to be thrown away, and some units overheated enough to spark small fires.
The worst-hit were Intermarché and Netto, owned by Les Mousquetaires, with 150 to 300 stores reported. Coopérative U said more than 100 of its supermarkets were targeted. Carrefour reported 80 of its 6,000 stores, Monoprix about five percent of its roughly 490, and E.Leclerc said several of its stores were hit. The total converges around 500 of France's 15,000 stores. Intermarché CEO Thierry Cotillard put national losses at tens of millions of euros in a single day.
Danfoss, the Danish engineering firm whose refrigeration-management software was hijacked, said the affected cold units were older models whose security software could not be updated to ward off a risk the company had already identified. The statement points to a familiar industrial-control problem: equipment with long service lives, legacy firmware that cannot be patched, and network connectivity added after the fact. Whether retailers applied the mitigations Danfoss had recommended for the known risk remains an open question in the investigation.
The Paris prosecutor's office opened a dedicated cybercrime investigation into what it called a large-scale attack on connected refrigerators at major food retail chains, confirming food losses and fires. Prime Minister Sébastien Lecornu ordered ANSSI, France's National Cybersecurity Agency, to investigate. France is also coordinating with European counterparts in case other countries are affected. European Food Commissioner Christophe Hansen condemned the hack, saying the weaponization of food had become a reality.
