The overnight attack on France's supermarket fridges

On the night of Sunday 11 October into Monday 12 October 2026, unknown attackers took control of the connected refrigeration systems of several of France's largest supermarket chains. By forcing the units through repeated heating cycles, they pushed temperatures inside the fridges to as high as 50 degrees Celsius (122 degrees Fahrenheit) and held them there for around six hours — turning machines built to keep food safe into machines that destroyed it.

When shop staff arrived on Monday morning and opened the refrigerated cabinets, many were met with a blast of hot air instead of cold. Across hundreds of stores, large quantities of chilled and frozen food had spent the night far above safe temperatures. The affected chains ordered the food discarded rather than risk selling it, and several stores reported fires in the overheated equipment. The Paris prosecutor's office described the incident as a large-scale attack affecting connected refrigerators across several major food retailers and opened a formal investigation the same day.

Which chains were hit, and how badly

Les Mousquetaires, the group behind the Intermarché brand, confirmed that at least 150 of its stores had their refrigeration heated to 50 degrees for about six hours overnight, and said all affected food had been thrown away to eliminate any sanitary risk. Coopérative U — which runs the Hyper U, Super U, U Express and Utile brands — said fewer than 100 of its stores were affected; its chief executive, Dominique Schelcher, confirmed the intrusion publicly and called an attack on equipment essential to preserving fresh food an unprecedented act of extreme gravity.

Carrefour reported that 80 of its supermarkets had been hit, while stressing that the vast majority of its roughly 6,000 stores were untouched. Monoprix, which operates about 490 stores in France, said around 5 per cent of them were affected, and the Leclerc brand was also named among the targeted groups. Financial damage was immediate: two Intermarché stores in Haguenau, in the Alsace region, reported combined losses of €270,000 in discarded stock alone. The figures are the retailers' own minimum confirmations and were expected to rise as stores completed their checks.

The French supermarket cyberattack: how the hackers got in

Investigators are still piecing together the attackers' path, but the emerging picture points to the refrigeration control software. French broadcaster BFMTV reported that the attackers targeted outdated control software supplied by the Danish manufacturer Danfoss, gaining remote access and forcing repeated defrost cycles that drove temperatures upward.

Security researchers have previously flagged this kind of equipment as a weak point. A research team from the cybersecurity firm Claroty demonstrated earlier in 2026 how certain Danfoss controllers could be compromised to disable cooling while falsifying the temperature readings shown to operators. That research has not been linked to this incident — the actual entry point the attackers used remains unconfirmed while the investigation runs.

Refrigeration controllers are trusted to run for years with little attention, often on old software, and they sit between the shop floor and the internet in ways few shoppers ever think about. Turning those controllers against their own machines is what made this attack unusual.

The official response

By Monday afternoon, the response was running on several tracks. The Paris prosecutor's office announced its investigation. The office of Prime Minister Sébastien Lecornu said the national cybersecurity agency ANSSI had been instructed to investigate, and that France was coordinating with European counterparts because other countries could also be affected. Europe's food commissioner, Christophe Hansen, condemned the attack publicly and said the weaponisation of food had become a reality demanding attention at every level.

The retailers moved to containment: isolating systems, calling in refrigeration engineers, and working through Monday to restore normal cold chains while staff hauled trolleys of defrosted food to waste containers.

Why officials treated it as a public-safety incident

Chilled and frozen food has a narrow safe zone, and the attackers blew straight through it. Perishable goods held above safe temperatures for hours grow bacteria that no reheating or refreezing can reliably kill, which is why every affected retailer chose to discard the food rather than restock it. The fires added a second dimension: when refrigeration equipment is forced far outside its designed range, components can fail catastrophically, and several stores reported exactly that. Nobody is reported to have been injured, but an attack that sets fire to retail equipment overnight is one safety layer away from a much worse outcome.

For shoppers, the response is what worked: because the food was destroyed and discarded, the risk of spoiled products reaching shelves was low. The cost fell on the companies — lost stock, damaged equipment, emergency repairs — rather than on customers' health.

How far the attack spread beyond France

The French case may be only part of a larger campaign. A threat-intelligence analyst at the firm Sekoia reported on Monday that supermarket chains in Spain, Portugal, Poland, Germany and Belgium had also been affected, though details from those countries were still thin in the first hours. Ahold Delhaize — the Dutch-Belgian group that operates the Netherlands' largest supermarket chain, Albert Heijn, and has substantial operations in the United States — said it was dealing with a security issue in its network and had taken several systems offline as a precaution, without confirming a connection to the French attack.

France's coordination with European counterparts suggests investigators assume the same attackers, or the same tooling, may have been aimed at more than one country's cold chain. The safest reading for now: France is confirmed, several neighbours are possible.

What we still do not know

As of Monday evening, no group had claimed responsibility, and the attackers' identity and motive were unknown. Investigators had not published indicators of compromise — the technical fingerprints other operators need to check their own systems — and the exact entry point remains unconfirmed. Vendor guidance and patches, once they exist, will matter far beyond France, because the same controller models are used across the retail food industry worldwide.

What our records show, and what they miss

Our live tracker at today follows incidents as they are verified, and the trending page shows which signals are drawing the most attention across countries and categories. A cyber-physical incident like this sits at the edge of what our records are built to catch: our World Incident Report for 5–12 October 2026 and our explainers track it from the disaster-and-safety angle — the food destroyed, the fires, the investigation — but they cannot tell you which software was compromised or who carried the attack out. Those answers belong to the criminal and technical investigations now under way.

The short version

  • What happened: attackers hacked the refrigeration systems of major French supermarket chains overnight on 11–12 October 2026, heating fridges to 50°C for about six hours.
  • Who was hit: at least 150 Intermarché stores, fewer than 100 Coopérative U stores, 80 Carrefour supermarkets and around 5 per cent of Monoprix stores; two Haguenau stores alone lost €270,000 in stock.
  • Why it matters: the attack destroyed food and started fires at some stores; the Paris prosecutor opened a case and ANSSI was instructed to investigate.
  • What shoppers should know: all affected food was discarded, so spoiled products reaching shelves is unlikely; the losses fell on the retailers, not on customer health.
  • What is still unknown: who did it, how they got in, and how far beyond France it reached — neighbouring European countries are being checked, but nothing is confirmed outside France yet.