A supermarket cyberattack that turned freezers into ovens hit about 700 stores in France, the country’s finance minister told Parliament on Tuesday. Overnight Oct. 11-12, hackers seized control of store refrigeration systems. They pushed temperatures to dangerous levels and forced retailers to throw away fresh and frozen food.
The incident marks a turning point for the industry. Instead of stealing data, the attackers went after the equipment that keeps food safe. For grocers in the United States, the message is hard to ignore.
France’s Finance Minister Sizes Up the Damage
Roland Lescure delivered the first official tally. According to The Associated Press, he told Parliament that about 700 of the country’s 10,000 supermarkets were affected. He said there was no risk to France’s food supplies, yet he also admitted the attack strikes at the core of the nation’s food security.
“It was a wake-up call for everyone,” Lescure said.
Meanwhile, authorities have moved quickly. The Paris prosecutor’s office said Tuesday that its cybercrime unit was investigating the large-scale attack, including the extent of damage from spoiled food and possible fires. Earlier, Prime Minister Sebastien Lecornu instructed France’s National Cybersecurity Agency (ANSSI) to investigate.
How the Supermarket Cyberattack Unfolded
According to Reuters, hackers forced the temperature of many French supermarket fridges up to 122 degrees Fahrenheit (50 degrees Celsius) overnight, causing fires and food losses.
The damage spread across major chains. Les Mousquetaires initially said about 150 of its stores were affected, with fridges heated to 50 C for six hours. A day later, the group raised its count. Groupement Mousquetaires, which operates more than 4,000 stores across Europe, told AP that the attack affected 300 of its Intermarché and Netto stores.
Other retailers reported their own losses. Carrefour said the attack reached 80 of its supermarkets, though the vast majority of its 6,000 stores escaped harm. Likewise, Monoprix, which operates about 490 stores in France, said 5 percent of its locations were affected. At Coopérative U, CEO Dominique Schelcher said the attack touched 80 of the company’s 2,000 stores. Most prevented disruptions to refrigeration, but some had to discard food.
The fallout also crossed borders. Felix Aime, a senior cyber threat intelligence analyst at Sekoia Threat Detection and Research, said the attack also reached Spain, Portugal, Poland, Germany and Belgium.
Outdated Firmware at the Center
The attackers targeted a single, widely used technology. French broadcaster BFMTV reported that hackers struck refrigeration control systems made by Danish manufacturer Danfoss and remotely triggered a forced, continuous defrost cycle.
Danfoss pointed to aging equipment. The company said Monday that most affected systems were older products that no longer received software or security updates. It added that it had long urged customers to keep firmware current and run systems behind a firewall.
Researchers had flagged the danger weeks earlier. At the DEF CON conference in August, Claroty’s Team82 presented its research on the Danfoss AK-SM 800A, and Danfoss later patched those flaws in firmware R4.3.1. However, no one has confirmed whether attackers exploited those specific flaws.
The financial toll keeps rising. Two supermarkets in Alsace reportedly suffered combined losses of €270,000 (about $302,000), and nationwide damage could reach several million euros. Worse, one retailer warned that insurance policies do not cover this type of in-store incident.
Related Article: AI in Food Safety and Quality Control Reshapes Global Supply Chains
What the Supermarket Cyberattack Means for U.S. Grocers
American retailers rely on similar technology. Commercial refrigeration, air conditioning, and food retail environments widely use these controllers. Moreover, supermarket cold aisles typically run on control panels that manage an entire store’s fridges and freezers, and technicians can reach them over the internet.
Federal officials have tracked the risk for over a year. The Cybersecurity and Infrastructure Security Agency (CISA) published an advisory on a flaw in the Danfoss AK-SM 8xxA model in May 2025.
The U.S. has also faced a troubling preview. Between Aug. 26 and 28, refrigeration breakdowns hit military commissaries in at least nine states, turning off coolers at Army, Navy and Air Force installations nearly at once. Military special agents are investigating those stateside outages. Officials, though, have never confirmed a cyber intrusion as the cause.
Separately, Ahold Delhaize reported a security problem the same week. AP noted that the disruptions forced a major grocer to shut down websites serving customers in Europe and the United States.
In the U.S., websites for its Stop & Shop, Giant, Hannaford and Food Lion stores displayed notices saying the sites were temporarily down. Still, Reuters found no clear link between the French attack and the problems Ahold Delhaize flagged.
Lessons From Past Food Supply Chain Attacks
Earlier breaches show how fast disruption spreads. In June 2025, distributor United Natural Foods Inc. (UNFI) disclosed unauthorized activity on its network. Executives later revealed the attack shut down its entire delivery network, and social media posts showed nearly empty shelves at some Whole Foods stores.
As a result, the French incident gives U.S. grocers a practical checklist. First, verify controller firmware and install current patches. Next, cut direct internet access to management interfaces; both Danfoss and Trane advise against exposing them online. Finally, test temperature alarms and response plans, because some stores limited the damage through quick detection.
As Lescure suggested, this attack should wake up the entire industry. Refrigeration now belongs on the cybersecurity agenda, right alongside payment systems and customer data.