What happened?
Overnight, hackers broke into the connected refrigeration systems of hundreds of French supermarkets and pushed temperatures as high as 50°C — 122°F. Frozen food thawed, chilled goods spoiled, and in some stores refrigeration equipment overheated so badly it melted or sparked fires. The food inside had to be thrown out by the truckload: French retailers say losses run into the millions of euros.
In Paris, resident Geert de Clercq watched staff at a local Intermarché wheel cart after cart of defrosted frozen food out to a trash container, molten ice cream sloshing onto the street. Similar scenes played out across the country.
Who was hit?
The attack was broad. France’s finance minister, Roland Lescure, told Parliament on Tuesday that roughly 700 of France’s 10,000 supermarkets were affected — around 7% of the country’s food retail network.
The biggest names in French grocery were all touched. Groupement Les Mousquetaires, which runs Intermarché and Netto, was among the hardest hit: Al Jazeera reported 300 of its stores affected, while CNN quoted one of its owners saying about 150 stores saw their systems heated to 50°C for roughly six hours overnight, with all the food inside discarded. Carrefour said 80 of its supermarkets were targeted. Coopérative U reported more than 100 of its stores hit. Monoprix said about 5% of its roughly 490 stores were affected, and E.Leclerc confirmed several of its locations were targeted.
Lescure said there was “no risk to food supplies,” but added that the attack “touches the heart of our food security” and should be “a wake-up call” — a reminder that supermarket shelves depend on software most shoppers never think about.
How did they do it?
The targeted hardware came from Danfoss, a Danish manufacturer whose AK-SM800 and AK-SC355 controllers manage refrigeration systems remotely. Danfoss told AFP that most of the affected units were “legacy” products running outdated firmware that it had previously advised customers to update.
According to BFM, the attackers triggered a forced-defrost cycle in the controllers — a normally routine maintenance function that, run to extremes overnight, cooked the contents of the fridges instead of just melting ice off the coils.
Felix Aime, an analyst at French cybersecurity firm Sekoia, said the attack went beyond France: Spain, Portugal, Poland, Germany and Belgium were also affected.
Who did it?
Nobody knows yet. The Paris prosecutor’s office described the incident as a “large-scale” attack on “connected refrigerators in several major food retailers,” and Prime Minister Sébastien Lecornu has ordered ANSSI, France’s national cybersecurity agency, to investigate, with France coordinating with its European counterparts.
The timing adds weight. The attack lands just weeks after President Emmanuel Macron ordered stepped-up protection of critical infrastructure against so-called “hybrid attacks” — a catch-all for sabotage, cyber intrusions and disinformation that France has been warning about more insistently this year.
Separately, on the same Tuesday, Dutch retail group Ahold Delhaize shut down some of its systems over a “security issue,” taking down websites for Albert Heijn in the Netherlands, Delhaize in Belgium, and Stop & Shop, Food Lion and Giant in the United States. Stores stayed open, and the company said it had found no evidence that customer or employee data was stolen. It is not known whether the two incidents are connected.
What happens now?
ANSSI’s investigation will try to answer the two questions that matter: who got in, and through which unlocked door. Danfoss’s own account points a finger at outdated firmware on legacy systems — which raises an uncomfortable question for every retailer running equipment they were told to update.
The stakes are larger than one bad night for the grocery business. As Dominique Schelcher, the CEO of Coopérative U, wrote on X: “Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented.”
Food supply chains have become as connected as everything else, and attacks like a ransomware attack that took down Arizona’s courts earlier this year show how fast a single weak point can cascade. Europe’s food system just learned the same lesson the hard way — and, as Lescure warned Parliament, this may be the wake-up call rather than the final alarm.
Attribution remains open: the FBI’s recent takedown of Chinese hacking infrastructure shows how state-linked cyber operations keep evolving — but in France’s case, nobody has yet said who did this.
