Hundreds of French supermarkets were struck by a large-scale cyber attack overnight that forced refrigeration units to heat up to 50C (120F), spoiling fresh and frozen food and causing fires in some locations.
Hackers gained control of software used to regulate temperatures in cold storage units, ordering them to heat up and remain hot rather than undergo the brief, slight temperature rise that normally occurs during overnight defrost cycles.
The Paris prosecutor's office confirmed it had opened a cyber-crime investigation, describing the incident as a "large-scale cyber-attack affecting connected refrigerators in several major food retailers across France" and noting that reported damage included "food losses and fires."
French Prime Minister Sebastien Lecornu instructed the national cybersecurity agency ANSSI to investigate. A person in his office said France was also coordinating with European counterparts, as other countries may be affected, while investigating whether other French firms were at risk.
The attack targeted software supplied by Danish engineering firm Danfoss, which allows retailers to manage refrigeration units remotely. Danfoss said it was "aware of incidents in France affecting a limited number of refrigeration management systems" and that the affected units "were running outdated firmware." The company added that it had "long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions."
Among the chains affected were Coopérative U, Intermarché and its Netto brand, Carrefour, Monoprix, and E.Leclerc. The full scale of the attack remains unclear, but figures from individual chains suggest around 500 stores were affected out of approximately 15,000 in France overall.
Les Mousquetaires Group, which owns Intermarché and Netto, said between 150 and 300 of its stores were hit, with fridges heated to 50C for six hours overnight. It said all affected food had been discarded to avoid health risks, and that staff were working to restock shelves as soon as possible. Some fresh and frozen food display units remained out of service on Monday afternoon.
Carrefour said fridges in 80 of its 6,000 stores were affected. Monoprix said approximately 5% of its more than 400 stores had been hit, with food removed from sale where its condition could not be guaranteed.
Managers arriving at branches on Monday morning were met by waves of hot air from the freezers. In some locations, small fires were reported. A French broadcaster published an image showing a freezer in an ice cream aisle displaying a temperature of 26.5C.
Two supermarkets in the Alsace region alone reported combined losses of 270,000 euros (228,000 pounds), suggesting the nationwide total could run into the millions.
Dominique Schelcher, chief executive of Coopérative U, said staff were "fully mobilised, in co-ordination with refrigeration specialists, to restore the situation as quickly as possible." He called the attack "of extreme gravity and unprecedented," adding that "targeting equipment essential to the preservation of fresh products and to the food supply of the French people is unacceptable."
European Food Commissioner Christophe Hansen condemned the hack in a post on X, writing: "Food security requires more attention at all levels. Because the weaponisation of food has become a reality."
The attack may not have been confined to France. Dutch supermarket group Ahold Delhaize, which owns the Albert Heijn chain in the Netherlands and Delhaize stores in Belgium and Luxembourg, said it was dealing with a "security issue" in its network and had taken several systems offline as a precaution. Stores in both countries remained open, but the company's online app and delivery service were down, and electronic price tags were displaying incorrect information. It was not confirmed whether the Ahold Delhaize incident was linked to the French attack.
