Cyberattack Disrupts Refrigeration Systems at French Supermarkets

This attack reveals critical weaknesses in the operational technology that underpins food safety and supply chains globally.

• A cyberattack on October 11-12, 2026, compromised refrigeration systems at hundreds of French supermarkets.
• Affected retailers included major chains like Intermarché, Carrefour, and E. Leclerc, leading to mass disposal of spoiled food.
• Ongoing investigations by Paris prosecutors and Danfoss highlight the need for improved cybersecurity in industrial control systems.

• Outdated firmware on Danfoss refrigeration controllers was exploited, allowing hackers to elevate temperatures and trigger defrost cycles.
• Prior research had flagged vulnerabilities in Danfoss systems, indicating a long-standing risk that was not addressed.
• No specific threat actors were identified, suggesting the attack was opportunistic, targeting exposed systems in the retail sector.

The cyberattack on French supermarkets is a stark reminder of the vulnerabilities inherent in operational technology (OT) systems, particularly in the food retail sector. The attackers exploited known weaknesses in legacy refrigeration management systems provided by Danfoss, specifically the AK-SM 800 and AK-SC 355 models. These systems, which no longer receive security updates, were left exposed to potential breaches, allowing hackers to gain remote access and manipulate temperature settings.

The attack unfolded overnight, with hackers forcing refrigeration units into extended defrost cycles, raising temperatures to 50°C (122°F). This led to widespread spoilage of perishable goods, resulting in significant financial losses for retailers and a public health risk due to the disposal of potentially hazardous food items. The immediate response from affected retailers involved the removal and destruction of compromised inventory, which included fresh produce and frozen goods, to mitigate health risks.

The incident has prompted a criminal investigation by Paris prosecutors, who are working to identify the perpetrators and assess the full extent of the damage. The French cybersecurity agency ANSSI has also engaged with affected parties to bolster defenses against future attacks. Danfoss has recommended that retailers migrate to updated systems to prevent similar incidents, highlighting the urgent need for improved cybersecurity measures in the food supply chain.

This attack not only disrupts operations but also raises broader questions about the security of connected systems in critical infrastructure. As the retail sector increasingly relies on digital solutions for efficiency, the risks associated with outdated technology become more pronounced. The incident serves as a wake-up call for businesses to prioritize cybersecurity and invest in modernizing their operational technology to safeguard against future threats.

• Retailers: Immediate financial losses from spoiled inventory and operational disruptions.
• Consumers: Potential shortages of fresh food and increased prices due to supply chain disruptions.
• Cybersecurity professionals: Increased demand for expertise in securing OT systems in the retail sector.

• Regulatory changes: Monitor for potential new regulations aimed at enhancing cybersecurity in the food supply chain.
• Industry responses: Watch how retailers adapt their cybersecurity strategies and invest in technology upgrades.
• Criminal investigations: Follow developments in the Paris prosecutors' investigation to understand the motivations and methods of the attackers.