50°C in the Fridges: The Unprecedented Cyberattack That Paralyzed Hundreds of French Supermarkets

On the night of Sunday 11 to Monday 12 October 2026, a cyberattack of unprecedented scale hit the refrigeration control systems of several hundred supermarkets in France. Temperatures climbed as high as 50°C, destroying thousands of tonnes of fresh and frozen food. The incident raises a direct question about the security of critical infrastructure.

This article will also interest you: 600,000 bank cards stolen: three AIs compromised hundreds of online stores

An "unprecedented" attack of "extreme gravity"

It was a scenario no one had planned for. During the night of 11–12 October 2026, attackers took remote control of refrigeration control systems in hundreds of French supermarkets. The aim was to push refrigerators and freezers to 50°C so the food inside would become unfit to eat.

"Attacking equipment that is essential to keeping fresh food safe and to supplying the French public is of extreme gravity, and it is unprecedented," Dominique Schelcher, chief executive of Coopérative U, said on X. "It is unacceptable."

Les Mousquetaires, the parent group of Intermarché, told Agence France-Presse that it had "never been the victim of a computer attack on refrigeration systems, which, on this scale, is unprecedented in any case."

Which chains were hit?

The toll grew through Monday 12 October. According to information gathered by BFMTV and confirmed by the chains to AFP:

• Intermarché: between 150 and 200 stores affected, out of a network of about 3,600 outlets in France.
• Coopérative U (Super U): fewer than a hundred stores concerned.
• E.Leclerc: some stores hit according to BFMTV, a claim the group had not confirmed at first.

Other chains and independent shops were also affected, including Metro stores and independent butcher shops. An Intermarché in the Manche, six supermarkets in the same department, a Leclerc in Pierry in the Marne: the list of victims kept growing through the day.

How did the attack work?

The attack targeted a critical point: refrigeration control systems made by the Danish manufacturer Danfoss, used by many large retail chains.

The attackers exploited a flaw affecting some older versions of the control software. They hijacked a function that is normally meant to protect the equipment: automatic defrost. That system, which clears frost built up inside the units, was forced on and held continuously, with the temperature setpoint fixed at 50°C.

According to ethical hacker SaxX, technicians administer this system remotely through a web server, with a management interface that can be opened in a browser. He summed up a malicious operation as something that can be done "in a few clicks." In his view, "the situation is critical."

In some stores, the attack began around midnight. The equipment heated for several hours. When staff opened the refrigerators, the scale of the damage was obvious. "A wave of heat escaped," a professional source in the sector told BFMTV.

Heavy financial losses

The consequences are severe for the chains that were hit. Every fresh and frozen product on display had to be thrown away as a health precaution.

The first figures show the size of the damage:

Nationwide, the bill could run into millions of euros.

Affected stores now have to follow a strict procedure: empty the refrigerated cases, have a bailiff record the damage, then discard the food. Intermarché said its teams were focused first on exceptional orders so shelves could be restocked as quickly as possible.

An investigation opened by the Paris prosecutor

Given the seriousness of the facts, the cybercrime section of the Paris prosecutor's office opened a case on its own initiative on Monday 12 October, under its national jurisdiction. The investigation was assigned to the Office anti-cybercriminalité (OFAC). It is meant to identify the victims and establish the link with the reported damage, including lost food and reported fires.

Dominique Schelcher called for an investigation "to shed full light on this unacceptable cyberattack."

What this attack says about critical infrastructure

Beyond the particular case of Danfoss, the attack exposes a systemic weakness: connected industrial systems that run everyday infrastructure.

Refrigeration controls are industrial control systems (ICS). Like much equipment of this kind, they are increasingly connected to the internet so they can be maintained remotely and supervised in real time. That connectivity has clear operational benefits, and it also widens the attack surface.

Recent precedents had already warned the sector. In September 2025, security researchers disclosed a series of critical vulnerabilities in widely deployed commercial refrigeration controllers. Those flaws made it possible to shut cooling off while the control screens still showed a normal temperature, a particularly dangerous outcome.

More recently, in the United States, refrigeration failures were reported at military sites in eleven states, prompting the Department of Defense to investigate a possible criminal cyber origin.

Danfoss recommends placing the equipment behind firewalls configured to allow only legitimate remote connections. That is a basic precaution, and it only helps if it is actually applied.

Lessons for operators

This attack should be a shock for grocery retail and, more broadly, for every organization that runs connected industrial control systems.

1. Map the systems and isolate them

Refrigeration controls should never be reachable directly from the internet. They belong on dedicated networks, behind firewalls, with remote access that is controlled and authenticated.

2. Keep the software updated

The attack targeted older versions of the control software. Obsolete equipment, for which security fixes are no longer published, is a favored way in. A regular update plan is essential.

3. Watch for abnormal behavior

A forced defrost at 50°C in the middle of the night is an anomaly that should have raised an alert. Real-time monitoring of critical settings (temperature, defrost cycles, connections) and automatic alerts are essential.

4. Plan for continuity

When an attack hits, chains need to switch quickly to a degraded mode of operation. That means clear emergency procedures, named contacts at suppliers, and coordination with the authorities.

5. Put cyber risk into the contracts

Contracts with manufacturers and integrators of control systems should include cybersecurity clauses: an obligation to ship fixes, vulnerability notification, and a service level if an incident occurs.

What to remember

Conclusion

This cyberattack is a turning point. It shows that attackers are no longer limited to personal data or banking systems. They are now going after the physical infrastructure that daily life depends on. Securing industrial control systems is a necessity if food supply, and public safety more broadly, are to be protected.