Cyberattack sabotages refrigeration systems at around 700 French supermarkets (2026)

On 13 October 2026, the French government confirmed that a cyberattack targeting refrigeration control systems had struck hundreds of supermarkets across France, in an unusual operational-technology sabotage campaign that spoiled food and, in some cases, started fires. Finance Minister Roland Lescure told lawmakers that around 700 of France's roughly 10,000 supermarkets had been affected, up from earlier estimates of 300 to 350. Stores belonging to several of the country's largest chains — including Intermarché (Les Mousquetaires), Carrefour, Coopérative U, E.Leclerc and Monoprix — were among the victims.

Rather than stealing data, the attackers manipulated the industrial controllers that regulate refrigeration. According to reporting cited by French media, they lengthened automatic defrost cycles from about one hour to as many as eight, which both raised temperatures and delayed the alarms that would normally flag a fault. At one Intermarché store, refrigeration units were reported to have run at around 50°C for six hours, forcing staff to discard all of the affected stock; the Paris prosecutor's office said the attack had also caused fires in some locations.

The compromised controllers

France's national cybersecurity agency, ANSSI, warned through its CERT-FR division on 12 October of compromises involving Danfoss AK-SM and AK-SC refrigeration controllers, and on 13 October extended the alert to Copeland XWEB and Dixell XWEB systems. Danfoss said that many of the hijacked units were older, end-of-life models — such as the AK-SM 800 and AK-SC 355 — that it no longer supports, along with some AK-SM 800A units running outdated firmware. Copeland, after initially declining to confirm the findings, acknowledged a vulnerability and said it was "working with impacted customers to mitigate the risk."

CERT-FR did not tie the intrusions to a single, specific vulnerability, and advised operators to disconnect the controllers or restrict access to them, cautioning that for compromised end-of-life devices "a factory reset alone is not enough." Internet-scanning firm Censys reported that nearly 3,000 Danfoss StoreView control panels were exposed online on 11 October, more than 1,800 of them in France; by 14 October the French count had fallen to 537, suggesting operators were pulling the devices offline.

Investigation and open questions

The Paris prosecutor's office confirmed that its cybercrime section had opened an investigation, entrusted to France's anti-cybercrime office. As of mid-October, investigators had identified no culprits, and — unusually for an attack of this scale — no hacktivist group or ransomware crew had claimed responsibility and no ransom had been demanded. Security researchers at Sekoia told reporters that stores in Spain, Portugal, Poland, Germany and Belgium appeared to have been affected as well, though without further detail, raising the prospect of a broader European campaign against retail refrigeration systems.