Cyberattack on Connected Refrigeration Hits 500 French Stores
Attackers raised fridge temperatures to 50 degrees and extended defrost cycles, causing food spoilage and fire damage at major French supermarket chains.
A cyberattack targeting internet-connected refrigerated and frozen equipment disrupted cooling at more than 500 French supermarkets between the night of October 11 and the early hours of October 12, 2026, according to dailysecu.com. Attackers exploited remote control features to raise fridge temperatures up to 50 degrees and force defrost cycles.
Affected chains included Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc. About 300 Intermarché and Netto stores were hit, along with over 100 Coopérative U stores, about 80 Carrefour stores and about 30 Monoprix stores, bringing total damage to an estimated more than 500 stores.
Defrost times were altered from 1 hour to 8 hours, causing prolonged temperature rises and equipment overheating. Sprinklers activated and fire damage occurred. At one Intermarché store in the Gironde region, a delivery driver found water pooling in a cold storage room, leading the store to discard about 21,000 euros worth of food.
Investigations underway
Danfoss remote refrigeration control systems were identified as a likely attack path, and on October 13 similar attacks were confirmed at stores using Dixell products. The Paris prosecutor's office and France's national cybersecurity agency ANSSI have opened investigations.
Defrost is a normal function designed to remove frost from cooling systems by pausing cooling or applying heat for a set period.
Quick answers
Which French supermarket chains were affected by the refrigeration cyberattack?
Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc were affected, with total damage estimated at more than 500 stores.
What caused the food spoilage and fire damage?
Attackers exploited remote control features to raise fridge temperatures up to 50 degrees and altered defrost times from 1 hour to 8 hours, causing overheating, sprinkler activation and fire damage.
Who is investigating the attack?
The Paris prosecutor's office and France's national cybersecurity agency ANSSI have opened investigations.