You don’t need blocked checkout lanes or empty shelves to cause problems for a supermarket. All it takes is a disruption to the systems that keep food fresh. That’s exactly what happened in France, where a cyberattack on the night of October 11–12 compromised the refrigeration systems of hundreds of stores, resulting in massive losses of merchandise and economic damages amounting to millions of euros.
The incident affected several major retail chains, including Intermarché, Coopérative U, E.Leclerc, and Carrefour. According to initial reports, the hackers managed to remotely access the control systems of refrigerators and freezers, altering their operation. In some stores, temperatures reportedly rose as high as 50 degrees, rendering large quantities of perishable goods unusable.
Meat, dairy products, cured meats, vegetables, and frozen foods are among the affected goods. The problem goes beyond the commercial value of the lost goods: when temperature control is lost, food safety can no longer be guaranteed, and the products must be discarded.
The Flaw in the Control Systems
At the center of the investigation is the technology used to manage refrigeration systems. Suspicions are focused on systems from the Danish group Danfoss, which allow for remote monitoring and adjustment of refrigeration equipment. This solution enables the coordination of systems across numerous retail locations, but it can become a point of entry for attackers if cybersecurity protections are inadequate.
The problem would not be entirely unexpected. In August, Team82, the cybersecurity research group at Claroty, had documented vulnerabilities in Danfoss control systems. The company had subsequently released software patches. Investigators will need to determine whether the systems affected by the attack in France were still vulnerable to those flaws and whether the necessary updates had been installed.
This incident highlights a critical issue that extends beyond the food distribution sector: cybersecurity is not limited to computers, databases, and customer data, but also encompasses the physical equipment that controls essential operations. Unauthorized access can result in immediate material damage, with consequences that ripple throughout the supply chain.
A Coordinated Attack? All Possibilities Remain Open
The Paris prosecutor’s office has launched an investigation to reconstruct the sequence of events surrounding the attack and identify those responsible. At this time, no group has claimed responsibility, and the motive has not been established. Possible theories include a destabilization operation and an attack carried out by cybercriminals, but there is insufficient evidence to definitively attribute the operation to a specific organization.
At the same time, IT issues also affected some distribution operations in the Netherlands and Belgium. The possible connection between these incidents has yet to be verified: the timing alone does not prove the existence of a coordinated campaign.
The priority now is to determine the source of the attack and secure the systems. For large-scale retailers, the lesson is clear: updating systems, limiting remote access, and monitoring network-connected devices is no longer just a technical issue. It is also a way to protect merchandise, businesses, and food safety.
