The attack targeted the refrigeration control systems of top retailers, including E. Leclerc, Intermarché, and Coopérative U. Paris prosecutors confirmed the incident, noting that the manipulation of connected appliances had led to significant food losses and safety hazards. Coopérative U’s chief executive, Dominique Schelcher, described the event as “unprecedented” for the retail sector.
According to technical details emerging from the investigation, hackers managed to remotely trigger the forced defrosting function of refrigeration systems. In some stores, fully stocked freezers were heated to 50 degrees Celsius (122 Fahrenheit) for more than six hours. This extreme temperature spike caused frozen goods, including ice cream and meat, to melt, rendering them unsafe for consumption. Staff at affected Intermarché locations were seen disposing of cartfuls of defrosted products into large waste containers.
The scope of the damage has been quantified by several retailers. Les Mousquetaires, the owner of Intermarché, stated that approximately 150 of its stores were impacted, with refrigerators heated to 50°C. Intermarché confirmed that at least 300 shops, including those under its Netto brand, were targeted. Coopérative U reported that over 100 of its outlets suffered similar disruptions. E. Leclerc acknowledged that a cyberattack affected one of its refrigeration equipment suppliers, resulting in operational repercussions in several of its stores. Other major chains, including Carrefour Market and Monoprix, have also been linked to the incident, with Monoprix stating that five percent of its roughly 490 stores were affected, and Carrefour reporting that 80 of its supermarkets were hit.
Legacy Hardware and Security Gaps
Investigations point to a vulnerability in software supplied by Danish manufacturer Danfoss. A source close to the issue identified that Danfoss refrigeration control systems were the specific target. Danfoss stated that most of the affected equipment consisted of “legacy” products that no longer receive software or security updates. The company specifically cited its AK-SM800 and AK-SC355 fridge regulator systems, noting that a version of the former was running “outdated firmware.” Danfoss added that it had long advised customers to migrate from these models to current-generation solutions but did not provide figures on the total number of affected units.
France’s National Cybersecurity Agency (ANSSI) has been tasked with investigating the attack by Prime Minister Sébastien Lecornu’s office. Authorities have already identified the vulnerability in the Danish supplier’s software and have contacted the vendor. The government is coordinating with European counterparts, as there are indications that the attack may have had broader regional implications.
Cyber threat intelligence analysts have suggested that countries including Spain, Portugal, Poland, Germany, and Belgium may also have been affected. In Belgium, Luxembourg, and the Netherlands, security issues related to refrigeration systems were reported. Dutch supermarket chain Ahold Delhaize said it had taken refrigeration systems offline as a precaution, though it stated it saw no direct connection to the French attacks.
“Food security requires more attention at all levels,” said EU food and agriculture commissioner Christophe Hansen, condemning the incident and labeling the “exploitation of food” as a new reality.
The incident has sparked broader concerns about the security of industrial control systems in the food supply chain. As retailers increasingly integrate connected devices for energy efficiency and management, the reliance on legacy hardware with outdated security protocols creates significant risks. The attack occurred amid heightened sensitivity toward cyber threats targeting critical infrastructure, particularly in the context of ongoing geopolitical tensions.
Currently, no group or individual has claimed responsibility for the cyberattack. French authorities are assessing whether other companies remain at risk and are working to determine the extent of the breach across the European retail sector. The immediate priority for affected retailers is mitigating health risks by ensuring all potentially compromised food is destroyed, while long-term efforts will focus on updating obsolete refrigeration infrastructure.
