Hackers manipulated refrigeration systems at hundreds of French supermarkets overnight, raising temperatures to as high as 50 degrees Celsius (122 degrees Fahrenheit). The Paris prosecutor's office confirmed on Monday, October 12, 2026, that the large-scale cyberattack caused fires and spoiled food across several major retailers. Prime Minister Sebastien Lecornu has directed the National Cybersecurity Agency (ANSSI) to investigate the breach.
The incident reportedly targeted connected control panels that allow maintenance firms to manage refrigeration remotely over the internet. ANSSI investigators identified a vulnerability in software provided by the Danish firm Danfoss. The company stated that the affected units were running outdated firmware and noted it had previously advised customers to update their systems or migrate to newer technology. A research report by Claroty’s Team82 in August had already identified vulnerabilities in certain Danfoss controllers that could permit unauthorized code execution.
Retailers reported varying levels of impact across their networks. Les Mousquetaires, which owns Intermarche, stated that approximately 150 stores saw temperatures rise for six hours, necessitating the disposal of all affected food. Carrefour reported 80 stores were hit, while Monoprix said 5% of its 490 locations were affected. Cooperative U CEO Dominique Schelcher confirmed his group was also targeted, while retailers E.Leclerc and Auchan did not immediately comment on the situation.
The event also impacts international retail operations and supply chain security. Dutch retailer Ahold Delhaize reported a separate "security issue" on the same day, taking systems offline as a precaution. This resulted in the suspension of grocery deliveries for Albert Heijn, which accounts for 10% of its sales. In the United States, websites for Ahold-owned chains Stop & Shop, Giant, Hannaford, and Food Lion were temporarily taken down. While Ahold stated there was no confirmed link to the French attacks, the disruption reflects a broader vulnerability in internet-connected industrial equipment used to maintain the food supply.
Future operations depend on the speed of firmware updates and system restoration. The French retail association Fédération du Commerce et de la Distribution (FCD) reported that some stores have already resumed normal operations, though they are seeking full transparency from Danfoss regarding the software vulnerability. The Paris prosecutor’s office and ANSSI continue to assess whether other French companies remain at risk. No specific deadline for the completion of the government investigation has been reported.