French supermarket workers arrived on Monday morning to find their freezer aisles blowing hot air. Overnight, hackers had seized remote control of the stores' refrigeration systems and forced temperatures up to 50°C (122°F) — turning freezers into ovens, spoiling tonnes of fresh and frozen food, and even sparking small fires. Hundreds of stores across France were hit in what officials are calling an unprecedented, large-scale cyberattack on the country's food supply.
The story is trending per news coverage across France and Europe, with outlets from the BBC and Reuters to BFMTV and The Times leading coverage as the scale of the incident becomes clear. Here is what we know so far — how the attack worked, who was hit, and why cybersecurity experts say it marks a watershed moment for critical infrastructure.
What happened
The attack unfolded overnight between Sunday and Monday, 11–12 October 2026. When staff opened their stores on Monday morning, they were met by waves of hot air pouring out of freezer units. A Paris resident described watching workers at an Intermarché in central Paris haul cartfuls of defrosted frozen food into a giant trash container on the street, melted ice cream sloshing out of broken tubs. French broadcaster BFMTV published a photograph of a freezer in an ice cream aisle displaying a temperature of 26.5°C — far above freezing — while staff at other stores said their units had been driven to a full 50°C for hours.
The scale is striking. More than 400 supermarkets were affected, according to industry reporting. Les Mousquetaires, the group behind Intermarché, said fridges at around 150 of its stores had been heated to 50°C for six hours overnight into Monday, and that all affected food was thrown away to eliminate any health risk; around 100 further shops were disconnected from the internet as a precaution. Coopérative U said more than 100 of its supermarkets were targeted. Carrefour said fridges in 80 of its 6,000 stores had been hacked. Monoprix reported that about 5% of its more than 400 stores were hit. France's largest supermarket chain, E. Leclerc, confirmed a cyberattack affecting one of its refrigeration equipment suppliers, with repercussions for refrigeration systems in several stores, while BFMTV reported hackers had remotely triggered forced defrosting in numerous Leclerc outlets.
The financial damage is already mounting. Two supermarkets in the Alsace region alone reported combined losses of €270,000 between them, and with hundreds of stores discarding entire fresh and frozen inventories, the nationwide total is expected to run into the millions of euros. The Paris prosecutor's office confirmed the incident had caused both food losses and fires at affected locations.
How the hackers pulled it off
Modern supermarket refrigeration is run by networked control panels that manage an entire store's fridges and freezers — and, crucially, they can be accessed over the internet so maintenance companies can adjust temperatures remotely. That convenience became the attack vector.
According to BFMTV, the hackers hijacked the fridges' defrost feature — the cycle normally used briefly to clear frost — and forced it to run non-stop, heating the units instead of cooling them. The control systems in question were supplied by Danfoss, the Danish engineering company whose equipment is used widely across European retail. An internal communication from the Intermarché network, dated Monday 12 October and reviewed by BFMTV, confirmed the attack had struck during the night at Danfoss's systems, and a crisis meeting was scheduled for Monday morning between refrigeration-sector providers including installation specialist Axima and Danfoss itself.
Danfoss said it was aware of incidents in France affecting a limited number of refrigeration management systems, adding that the compromised installations were older models running outdated firmware that "no longer receive software or security updates" — and that the company had long advised customers to keep supported systems updated and migrate legacy systems to current-generation solutions. The vulnerability appears to have been known: on 9 August, cybersecurity firm Claroty's Team82 published research detailing flaws in the Danfoss AK-SM 800A controller that could have allowed attackers to bypass authentication controls and execute code on compromised devices.
France's national cybersecurity agency, ANSSI, identified the vulnerability in software supplied by the Danish company and contacted the vendor, according to a source close to the prime minister's office. This is not the year's first headline-grabbing cyber incident — Oracle's massive 2026 health data breach showed how a single weak point in widely used software can expose millions of people, and the same pattern is visible here.
It may not be confined to France
The attack appears to have crossed borders. Dutch supermarket operator Ahold Delhaize — which runs Albert Heijn, the Netherlands' largest supermarket chain — said it was also dealing with a "security issue" in its network and had taken several systems offline to protect them. Its smartphone app told customers that, owing to a "cybersecurity incident", it was unable to deliver groceries; online orders represent around 10% of Albert Heijn's sales, and Dutch media reported rivals had seen an influx of delivery orders. Physical stores stayed open, though electronic price tags were reportedly displaying wrong information. Delhaize supermarkets in Belgium and Luxembourg were also affected by the security issue, according to Belgian media. In the United States, where Ahold Delhaize is the fourth-largest grocery retailer, websites for its Stop & Shop, Giant, Hannaford and Food Lion brands carried "site temporarily down" notices. Whether any of this is linked to the French attack remains unclear.
Félix Aimé, a senior cyber threat intelligence analyst at Sekoia Threat Detection and Research, told reporters that stores in Spain, Portugal, Poland, Germany and Belgium had also been affected. France was coordinating with its European counterparts, the prime minister's office said, while authorities assessed whether other French companies could be at risk.
There is also a troubling precedent: industry reporting noted the incident resembles disruptions at around a dozen US military commissaries in late August that led to food losses after refrigeration units were similarly affected.
The official response
The Paris prosecutor's office opened a specific cyber-crime investigation, describing the incident as a "large-scale cyber-attack affecting the refrigerators of several major food retailers across France". Prosecutors said the investigation would identify the victims and establish the link with the reported damage — the loss of foodstuffs and the triggering of fire alarms.
Prime Minister Sébastien Lecornu instructed ANSSI to investigate the attack, his office confirmed. The reaction from the retail industry was stark. Dominique Schelcher, chief executive of Coopérative U, called the attack "extremely serious and unprecedented", writing on X that "targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented." European retail association Eurocommerce said the incident underlined the importance of resilience across the entire supply chain.
European Food Commissioner Christophe Hansen condemned the hack in a post on X, writing: "Food security requires more attention at all levels. Because the weaponisation of food has become a reality." The language was pointed: it came just a month after President Emmanuel Macron ordered measures to protect France's critical infrastructure from what he described as Russian "hybrid attacks", amid growing European concern about the havoc malicious actors can cause across all sectors.
Why this attack is a watershed
Cyberattacks on hospitals, pipelines and power grids are grimly familiar. But remotely turning a nation's supermarket freezers into ovens — destroying food on an industrial scale without setting foot in a store — crosses a new line. It is a direct assault on the food supply chain, and it demonstrates how operational technology (the systems that run physical equipment) can become a weapon when it is exposed to the internet on outdated, unpatched firmware.
Security experts say the lesson is the one the industry has been repeating for years: legacy industrial systems that were never designed to be online are now routinely managed remotely, often with weak authentication and infrequent updates. Retailers kept their shelves stocked by remote-managing temperatures from anywhere — and that same remote door was left open to attackers. For a deeper look at how attackers exploit exactly this kind of weakness, see our guide on what cybersecurity is and how to protect yourself online.
The incident also raises hard questions for regulators. If hundreds of stores across multiple countries can have their refrigeration systems hijacked in a single night through one equipment supplier's legacy software, how many other single points of failure are sitting quietly in Europe's food, water and energy infrastructure? Hansen's "weaponisation of food" comment suggests Brussels now sees food logistics as a front line of European security, not just a commercial concern.
What happens next
The investigation is in its early stages, and there is no public attribution yet — officials have not said who carried out the attack or what their motive was. The full scale remains unclear, with the Paris prosecutor's inquiry still identifying victims and quantifying damage, and ANSSI assessing whether other French firms are exposed.
For retailers, the immediate response has been triage: discarding all spoiled food, disconnecting vulnerable units from the internet, and working with refrigeration specialists to restore safe temperatures — though some fresh and frozen display units remained out of service on Monday afternoon while shelves were restocked. Longer term, the industry faces pressure to replace legacy Danfoss controllers and patch everything that can be patched, exactly as the vendor has been advising.
What to watch: whether investigators attribute the attack and to whom; whether the Dutch and Belgian incidents are formally linked to the French hack; how quickly retailers retire the vulnerable legacy systems; and whether European regulators respond with new mandatory cybersecurity standards for food-supply infrastructure. For now, the image of the night will endure: supermarket staff arriving at work to the smell of thawing food and waves of hot air from freezers that had been silently turned against them.
Sources
Reporting drawn from the BBC, Reuters, AFP, BFMTV, The Times, Cybernews, Help Net Security, Nexa News, Newsbeep and National Cyber Security; analysis from Claroty's Team82 (9 August 2026) and Sekoia Threat Detection and Research; statements from the Paris prosecutor's office, the office of Prime Minister Sébastien Lecornu, France's ANSSI, Danfoss, Coopérative U, Les Mousquetaires (Intermarché/Netto), Carrefour and Eurocommerce; and a post on X by EU Food Commissioner Christophe Hansen (12 October 2026). Unconfirmed details are attributed to the outlets reporting them.