A large scale cyberattack targeting refrigeration control systems disrupted operations at hundreds of supermarkets across France, causing significant food losses and drawing attention to cybersecurity risks within connected operational technology environments. The incident occurred overnight between October 11 and 12, affecting several major retail chains including Intermarché, Netto, Coopérative U, Carrefour, Monoprix and a number of E.Leclerc stores. According to reports from Le Monde, nearly 300 Intermarché and Netto outlets, around 100 Coopérative U stores, 80 Carrefour locations and approximately 30 Monoprix branches experienced disruptions, while several wholesale cold storage operators were also impacted. The attack affected refrigeration systems responsible for maintaining food storage temperatures, forcing some retailers to temporarily close affected locations while staff removed spoiled products. Although nationwide losses have yet to be fully calculated, retailers expect damages to reach several million euros due to product spoilage and operational disruption.
According to available reporting, the attackers manipulated refrigeration settings by increasing defrost temperatures to approximately 50 degrees Celsius while extending defrost cycles from one hour to eight hours. The changes delayed automated alarms and slowed response efforts, allowing refrigeration failures to continue for longer periods before being detected. One Intermarché outlet in Gradignan reportedly lost products worth approximately €21,000 at purchase value because of the disruption. Les Mousquetaires, the retail group operating Intermarché and Netto stores, stated that nearly 180 of its outlets were affected and estimated that financial losses would reach several million euros. Investigators believe the reported entry point involved refrigeration control software supplied by Danish manufacturer Danfoss. The company indicated that many of the affected installations relied on obsolete equipment that no longer received software updates or security patches. Danfoss had previously issued security advisories during 2025 concerning vulnerabilities affecting parts of its software portfolio and had advised customers to install available updates where applicable.
Authorities have not publicly identified those responsible for the cyberattack, and no individual or group had claimed responsibility at the time of reporting. France’s Paris prosecutor’s office has opened an investigation while National Cybersecurity Agency of France, ANSSI, is examining the incident at both national and European levels. Officials are working to determine the total number of affected organizations, identify how the refrigeration systems were accessed and assess whether outdated software versions contributed to the attack. Investigators are also reviewing the relationship between previously disclosed vulnerabilities, unsupported equipment and the reported financial damage. As attribution has not been established, officials have not linked the incident to any specific threat actor or organization. The investigation remains ongoing as authorities continue coordinating with European cybersecurity counterparts and affected businesses to understand the full scope of the incident.
The incident has highlighted broader concerns surrounding operational technology security and the risks posed by unsupported industrial systems connected to business networks. Security experts note that outdated controllers and legacy software can remain in service for years after vendor support has ended, creating long term exposure if compensating security measures are not implemented. Organizations operating refrigeration systems and other industrial equipment are encouraged to review whether their controllers remain supported, apply available security updates, restrict unnecessary internet connectivity and carefully manage remote maintenance access. Monitoring systems and alarm mechanisms should also be tested to ensure they can detect unauthorized operational changes, while incident response plans should include manual temperature verification, safe shutdown procedures and clear guidance on handling compromised products. The France supermarket incident demonstrates that cyber incidents affecting operational technology can extend well beyond traditional information theft, disrupting essential services, damaging physical assets and creating significant financial and supply chain consequences across multiple organizations simultaneously.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
