A widespread cyberattack targeting the refrigeration systems of major French supermarket chains caused significant food spoilage and prompted outbreaks of fire overnight from Sunday, October 11, into Monday, October 12, 2026. Paris prosecutors confirmed the attack on October 12, 2026, and indicated it had led to these fires, initiating a probe into the incident. The scale and nature of the attack have sent ripples of concern through the retail and cybersecurity sectors across Europe.
Intermarché and Coopérative U, two prominent retailers, were confirmed victims of the digital assault. AFP reported on October 12, 2026, that between 150 and 200 Intermarché shops and nearly 100 Coopérative U outlets were affected. The attack forced refrigeration units to defrost, leading to the immediate ruin of vast quantities of fresh and frozen goods. Intermarché informed AFP on the same day that affected branches would be compelled to "throw away all of the products" from these categories, a devastating blow to inventory and consumer access to essential foodstuffs.
Dominique Schelcher, president of Coopérative U, described the incident as "extremely serious" and "unprecedented" on Monday morning, October 12, 2026, as reported by Tom's Hardware. His statement underscored the gravity of the situation, highlighting that "A cyberattack has been affecting the refrigeration production facilities of several stores in our network since last night." The deliberate targeting of critical infrastructure within the food supply chain represents a new frontier in cyber warfare, moving beyond data theft to direct physical disruption and damage.
The sophisticated nature of the attack involved hackers remotely triggering forced defrost cycles, pushing temperature setpoints as high as 50°C. BFMTV reported on October 12, 2026, that the compromised systems are administered by Danish refrigeration provider Danfoss, and the attackers specifically targeted outdated versions of the manufacturer's control software. This detail points to a common vulnerability in industrial control systems (ICS) where legacy software, often difficult to update in complex operational environments, becomes a prime target for malicious actors. Cooling Post corroborated this information on October 12, 2026, noting that cyberattackers took control of refrigeration systems in hundreds of supermarkets in France, altering temperature settings and defrosting produce, with older Danfoss control software versions being the vulnerability point. The attack's timing, beginning overnight from Sunday, October 11, into Monday, October 12, 2026, was also confirmed by BFMTV and Demócrata, suggesting a coordinated effort to maximize disruption during non-operational hours.
While Intermarché and Coopérative U have confirmed their direct involvement, reports suggest the attack may have cast a wider net. It is alleged that other major chains, including E.Leclerc, Carrefour, Monoprix, and Metro stores, along with independent businesses such as butcher shops, were also hit. BFM TV specifically stated that France's largest supermarket chain, E. Leclerc, was affected, with hackers "managing to remotely trigger the forced defrosting of the refrigeration systems in numerous stores." However, E. Leclerc did not immediately confirm this information when contacted by AFP on October 12, 2026, indicating that the full scope of the incident is still being assessed by retailers.
The financial repercussions of the attack are expected to be substantial, with initial estimates painting a grim picture. Early reports indicate losses are already approaching 300,000 euros, though these figures could escalate rapidly to several million euros nationwide as the full extent of spoiled inventory and operational downtime becomes clear. Intermarché's parent company, Groupement Mousquetaires, estimates their total losses alone at "several million euros," a figure that underscores the severe economic impact on individual businesses. Beyond the immediate spoilage, the attack is reportedly affecting deliveries and in-store pricing, particularly those powered by electronic shelf labels, which rely on integrated systems that may have been compromised or taken offline as a precaution. There are also significant concerns regarding insurance coverage; Intermarché warned that some policies might not "cover this type" of in-store incident, potentially leaving retailers to bear the brunt of these unexpected and massive losses.
The geographical scope of the attack is also a subject of ongoing assessment. While confirmed in France, it is reportedly affecting operations in Belgium and the Netherlands as well, suggesting a broader, perhaps international, campaign targeting European food retail infrastructure. The programmed temperature reaching 50 degrees does not necessarily mean that all refrigerators physically attained that temperature, but the intent to cause maximum damage to perishable goods was clear, creating conditions ripe for spoilage and, in some cases, contributing to the outbreak of fires. The precise mechanisms by which these fires ignited are part of the ongoing investigation by Paris prosecutors.
As of October 12, 2026, the identity of the attackers remains unconfirmed. Investigators are working to determine the precise method of entry into the control systems, whether it involved exposed remote access, compromised credentials, unpatched vulnerabilities, or another route. The lack of immediate clarity on the attack vector complicates efforts to prevent future incidents and highlights the evolving sophistication of cyber threats against operational technology. Danfoss, the manufacturer of the targeted refrigeration control software, has not yet publicly commented on the incident, leaving many questions unanswered about the security protocols and update mechanisms for their widely used systems. The probe opened by Paris prosecutors is aimed at identifying all victims and establishing a clear link between the reported damage, including extensive foodstuff losses and the outbreaks of fires, to build a comprehensive understanding of the crime. The full extent of this unprecedented cyberattack and its long-term implications for food supply chains, critical infrastructure resilience, and cybersecurity strategies are still unfolding, promising a period of intense scrutiny and potential reform in how essential services protect themselves from digital threats.