Cyberattack triggers forced defrost in hundreds of French supermarket fridges

Hundreds of French supermarkets were forced to throw away fresh and frozen stock after a cyberattack sent refrigeration systems into forced defrost, driving temperatures up in stores across the country.

According to reporting by RNZ citing AFP, the major retailers E. Leclerc, Intermarché and Coopérative U all confirmed being hit. At least 300 Intermarché or Netto stores were affected, along with more than 100 Coopérative U outlets and several E. Leclerc sites. Intermarché said affected branches would have to discard all fresh and frozen products, though it gave no financial figures.

How the attack played out

French broadcaster BFM TV reported that the attackers remotely triggered forced defrosting of refrigeration systems in numerous stores, altering temperatures remotely and destroying stocks of fresh and frozen goods. Paris prosecutors confirmed the attack, which they said also sparked fires, and have opened an investigation into what they described as a large-scale cyberattack on the refrigerators of several major food retail chains across France. The probe will seek to identify the victims and connect reported food losses and fire outbreaks to the intrusion.

The specialist retail news site jebosseengrandedistribution.fr reported that Carrefour Market and Monoprix were also affected, but neither company has confirmed this, according to RNZ.

Coopérative U chief executive Dominique Schelcher, who confirmed that refrigeration had been affected since Sunday night, called the incident unprecedented and unacceptable, saying that equipment essential to preserving fresh food and to feeding the French population had been deliberately targeted. He added that a full investigation would be needed to shed light on the attack.

The compromised supplier

E. Leclerc said the intrusion affected one of its refrigeration equipment suppliers, with knock-on effects on the operation of cooling systems in several stores. A source close to the matter told AFP that refrigeration control systems made by Danish manufacturer Danfoss were the target.

Danfoss said in a statement that most of the affected equipment consisted of legacy products that no longer receive software or security updates. It named its AK-SM800 and AK-SC355 fridge regulator systems as affected, including a version of the former running outdated firmware, and said it had long advised supermarkets to move off those models. The company provided no figures on how many systems were compromised.

Response and wider context

A person close to French Prime Minister Sébastien Lecornu said the national cybersecurity agency had identified a vulnerability in software supplied by the Danish company and contacted the vendor. The agency is liaising with European counterparts because other countries may be affected, and is working to identify other French companies involved in order to alert them and prevent further spread.

EU food and agriculture commissioner Christophe Hansen condemned the attack, arguing that food security requires more attention at every level and that the exploitation of food has become a reality.

The incident lands amid growing European concern about state-linked disruption. President Emmanuel Macron ordered measures last month to protect French critical infrastructure from Russian hybrid attacks. Antoine Hautin of cybersecurity consultancy Almond noted that industrial equipment such as refrigeration units, long isolated from the internet, is now connected through sensors and remote monitoring, and that hitting hundreds of units simultaneously points to a certain level of sophistication.

Why it matters

Most cyberattacks on retailers leak data or disrupt payments; this one destroyed physical goods, started fires and disrupted the food supply. It is a concrete demonstration of how legacy operational technology, especially devices that no longer receive security patches, can be turned against critical infrastructure, and how a single equipment supplier can become a choke point for an entire retail sector. With France's cyber agency warning that other countries and companies may still be affected, the incident is likely to increase pressure on retailers and industrial vendors to inventory, patch or replace connected equipment that has quietly outlived its security support.