Cyberattack raises temperatures in hundreds of French supermarket freezers

By The Conservative Desk (/journals/conservative-desk)

Employees at an Intermarché in central Paris tipped cartloads of thawed frozen goods into a large bin as melted ice cream ran onto the street. Geert de Clercq watched it happen. Overnight on Oct. 11–12, 2026, hackers had driven connected refrigeration as high as 50°C.

Fires broke out at several stores from the temperature spike. Paris prosecutors opened an investigation into the large-scale cyberattack. French Finance Minister Roland Lescure told Parliament that about 700 of France’s 10,000 supermarkets were affected. Retailers discarded fresh and frozen product when food safety could not be assured. An employee filled boxes of perished goods outside a supermarket in Paris the day after the attack.

Carrefour reported 80 stores hit out of 6,000. Monoprix said 5 percent of its roughly 490 stores were affected. Les Mousquetaires, the group behind Intermarché, put its figure at about 150 stores, with temperatures held at 50°C for six hours; other reports placed Intermarché and Netto near 300. Coopérative U reported more than 100 stores affected, with one account citing 80.

Dominique Schelcher, chief executive of Coopérative U, posted on X: "I confirm that a cyberattack has been affecting, since last night, the cold production facilities of several stores in our network Coopérative U." He wrote that teams were fully mobilized, in coordination with refrigeration specialists, "to restore the situation as quickly as possible. An investigation will be necessary to shed full light on this attack. Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented. It is unacceptable." In a parallel line he called the same targeting "extremely serious and is unprecedented. It is unacceptable."

Christophe Hansen wrote on X: "I strongly condemn the cyberattack targeting food products at Intermarche, Cooperative U, Leclerc. Food security requires more attention at all levels. Because the weaponization of food has become a reality." He repeated that food security "requires more attention at all levels."

Food security is national sovereignty and public safety in concrete form. Free enterprise takes the first loss when cold-chain gear is left reachable on the open internet, and ordinary households meet the result in wasted stock and higher prices. Limited government can open a probe and enforce the rule of law; it cannot stand over every legacy controller a private operator still runs.

Thierry Cotillard, Intermarché’s chief executive, said the nationwide bill could reach tens of millions of euros in a single day. Losses at two Alsace supermarkets alone were estimated at €270,000. A Les Mousquetaires spokesperson said every item from the affected units went into the trash to rule out health hazards.

Investigators examined refrigeration control systems from Danish manufacturer Danfoss, including the AK-SM800 and AK-SC355 lines. Danfoss said affected equipment was "legacy" and no longer receives software or security updates, and that some units ran outdated firmware the company had long advised customers to replace. Prime Minister Sebastien Lecornu directed French cybersecurity authorities to examine the incident. A source close to his office said a vulnerability in software supplied by a Danish company had been identified and the vendor contacted. How the intruders got in has not been made public. The record does not name the attackers, and no group has claimed responsibility.

Store cold aisles often answer to a single control panel reachable online so maintenance contractors can change settings from anywhere. Three cybersecurity specialists judged the attack easy to carry out, pointing to skipped updates and device interfaces left exposed. Ken Munro, a partner at Pen Test Partners, put it in plain terms: "Get it wrong and you get a smelly mess of defrosted food." Because the flaws were well documented, he argued, the attackers met little resistance and could easily be youngsters fooling around. Munro doubted a nation-state hand: other countries run internet-connected fridges, a state actor would have little reason to strike only a portion of French units, and the absence of any ransom or demand suggested the attackers did not grasp the commercial losses facing store owners.

Antoine Hautin of cybersecurity consultancy Almond noted that industrial equipment long isolated from the internet is now tied in through sensors or remote monitoring, and that hitting hundreds of units at once showed "a certain level of sophistication." Felix Aime, a senior threat intelligence analyst at Sekoia, reported effects in Spain, Portugal, Poland, Germany, and Belgium as well. Christel Delberghe, director general of Eurocommerce, said the incident "underlines the importance of resilience across the entire supply chain." Steven Lachance, a tech and cybersecurity analyst, called connected appliances a new reality and warned that similar methods could move toward medical or energy systems.

Retailers and vendors can fairly note that ripping out legacy industrial gear is costly, that remote access serves real maintenance work, and that manufacturers sunset products customers still depend on. The record does not show a full count of which stores declined updates or why. What it does show is that Danfoss had for years told customers to keep supported equipment on current firmware and to swap legacy units for current-generation products.

On Aug. 9, months before the temperatures spiked, Claroty’s Team82 published findings on AK-SM 800A flaws that included a hidden daily login code and a command injection bug enabling remote code execution.