In case grocery retailers needed more things to worry about, a large-scale cyberattack targeting supermarket refrigeration systems in France on October 11–12 caused refrigerators and freezers to heat to as high as 50°C (122°F), forcing retailers to discard spoiled fresh and frozen food.
Here’s what we know about the incident “across the pond.”
The attack affected hundreds of stores operated by major grocery chains, including Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E. Leclerc. French authorities opened a cybercrime investigation after reports of food losses and fires at affected locations.
The attack targeted refrigeration management systems using software supplied by Danish engineering company Danfoss. These systems regulate temperatures across supermarket refrigeration units and can be accessed remotely for maintenance and adjustments. Investigators said a vulnerability in Danfoss software was involved, while the company reported that affected equipment included older systems running outdated firmware or products that no longer receive software and security updates.
According to reporting on the incident, attackers remotely manipulated refrigeration controls, causing units to enter extended or continuous defrost cycles. The resulting temperature increases compromised food stored in chilled and frozen displays, prompting stores to remove affected products. Some locations discovered the problem overnight after refrigeration areas overheated and fire safety systems were triggered.
Hundreds of Stores Affected, Millions in Losses
The reported impact varied by retailer. Coopérative U confirmed that more than 100 of its supermarkets were targeted. Intermarché and its Netto discount brand also reported widespread disruption; separate reports cited approximately 180 affected stores, while other reporting put the combined number closer to 300. Carrefour reported 80 affected supermarkets, and Monoprix said approximately 5% of its roughly 490 French stores were affected. E.Leclerc was also identified among the retailers hit. Estimates of the total number of affected stores varied across reports, with some accounts citing more than 400 outlets.
The financial damage was significant. Reuters reported that losses across the industry could reach tens of millions of euros, although a definitive total had not been established. The damage included spoiled inventory and related disruption. Some stores began restoring operations, while retailers worked with refrigeration specialists to assess equipment, remove unsafe products and resume normal service. The French retail association Fédération du Commerce et de la Distribution called for full transparency from Danfoss regarding the incident.
Danfoss said the affected equipment was running outdated firmware or had reached the end of its supported life. The company has advised customers to update supported systems and migrate older equipment to current-generation solutions. Cybersecurity researchers at Claroty had previously disclosed vulnerabilities in the Danfoss AK-SM 800A controller that could allow attackers to bypass authentication and execute code on compromised devices. Investigators have not publicly confirmed the exact method used in this attack.
France’s National Cybersecurity Agency (ANSSI) is investigating the incident in coordination with European counterparts to determine whether other businesses or countries are at risk. Cybersecurity analyst Felix Aime of Sekoia Threat Detection and Research told Reuters that Spain, Portugal, Poland, Germany and Belgium may also have been affected. Authorities have not established the full geographic scope of the incident.
As of October 13, no group had publicly claimed responsibility, and investigators had not reported a ransom demand. The investigation into the French supermarket attack remains ongoing. Authorities and retailers are working to establish how the refrigeration systems were compromised, determine the extent of the damage and restore affected equipment.
U.S. Grocery Website Cyberattack
A separate cybersecurity incident involving Dutch retailer Ahold Delhaize also emerged during the same period. The company, which operates Albert Heijn in the Netherlands and Stop & Shop, Giant, Hannaford and Food Lion in the United States, said it had taken some systems offline as a precaution. Albert Heijn temporarily experienced grocery-delivery disruptions. Ahold Delhaize said there was no reason to link its incident to the attacks in France, and a connection had not been established. We received no additional comments from the AD banners Monday on stateside website outages.
As if retailers needed another thing to worry about, like checking the liability clauses in their smart-enabled refrigeration units to see who is liable in cases like this. We haven’t seen an attack like this – at least publicly in the states – of similar severity and damages.
Cybersecurity Is Now an Operating Risk
The French supermarket attack is a reminder that grocery retailers are only as resilient as the systems behind their shelves. Cybersecurity is often treated as an IT expense, but refrigeration, distribution, payments and inventory management are operating infrastructure. When one of those systems fails, the consequences move quickly from the digital world to the physical business: product is lost, stores are disrupted, suppliers face replenishment demands and margins take another hit.
The lesson for grocery executives is straightforward: critical infrastructure needs the same disciplined risk management applied to cash, food safety and supply continuity. That means knowing which systems are connected, which remain supported, who can access them remotely and how quickly operations can recover when controls fail.
No system can be made entirely immune to attack; the objective is to reduce the likelihood of failure, limit its reach and restore operations quickly. In a business built on thin margins and perishable inventory, resilience is not an abstract technology goal. It is an operating discipline with a measurable financial return.