Cyberattacks on French supermarkets target refrigeration systems

Hundreds of supermarkets in France have been hit by unprecedented cyberattacks that spoiled tonnes of food and raised concerns about the vulnerability of the food system to advanced technology.

The attacks appear to have targeted internet-connected refrigeration systems made by a Danish company. Hackers pushed the temperature of fridges and freezers up to 50°C at more than 500 stores and supermarkets nationwide. The supermarkets confirmed the incident on Monday.

France's cybersecurity agency recommended that businesses operating the affected freezer models immediately disconnect them from the internet — or restrict access — and update their software.

It is not yet clear who was behind the attacks, but authorities said an investigation has been opened.

What happened

According to retailers, hackers entered the refrigeration systems via the internet and remotely raised freezer and fridge temperatures to 50°C overnight while stores were closed. Millions of euros worth of food was spoiled. In some cases, the high temperatures also caused fires or melted equipment.

French supermarket chains including E-Leclerc, Intermarche, Carrefour, Monoprix and Cooperative U were all affected. At least 300 Intermarche stores, along with the Netto brand, were impacted. Cooperative U said more than 100 of its supermarkets were targeted, Carrefour recorded 80 affected stores, and Monoprix reported that about 5 percent of its nearly 490 stores were attacked.

Authorities are still investigating who was responsible and how the attack was carried out. French broadcaster BFM reported that the attacker group appeared to have remotely triggered a forced defrost mode in the refrigeration systems.

According to the French government's cybersecurity agency, the targeted systems were manufactured by Denmark's Danfoss, including the AK-SM800 and AK-SC355 models. Danfoss told AFP that most of the affected control systems were "legacy" products with "outdated firmware," and that the company had previously recommended that supermarkets update them.

AFP also reported that authorities are in contact with other European countries that could be affected. It is not yet clear exactly how much food was lost.

Have supermarkets been hit by cyberattacks before?

Yes. Similar attacks have been recorded elsewhere in Europe and the United States.

In April 2025, British retail and supermarket chain Marks and Spencer suffered a sophisticated ransomware attack. The company said it lost about £300 million (around $397 million) after being forced to suspend online and app orders. The attack was carried out by the hacker group Scattered Spider, using ransomware from DragonForce — another criminal group.

According to British media, the group also sought to attack Co-op and the iconic Harrods store in Knightsbridge.

Similar reports have emerged in the United States. In June 2025, United Natural Foods — a frozen food company supplying major brands such as Whole Foods — said it had detected a cyberattack that forced it to shut down its systems. The company did not disclose the nature of the attack.

Last November, Ahold Delhaize USA said it was hit by a cyberattack that disrupted operations at more than 2,000 stores, including Hannaford, Food Lion and Stop and Shop.

Why are supermarkets a target?

Because they are an easy target and the consequences can spread widely.

As the food and agriculture system becomes increasingly digital, analysts say supermarkets selling fresh food are increasingly vulnerable to attacks because of the nature of their goods.

The growing sophistication of cyberattacks means ordinary people and local businesses, third parties dependent on large chains, also become victims when supply chains are disrupted.

Speaking to Al Jazeera, technology and cybersecurity analyst Steven Lachance said smart, internet-connected devices will always be vulnerable when hackers exploit security gaps to log in remotely and trigger malicious features.

"This is the new reality when you have such connected devices," Lachance said, noting that attacks could expand to target healthcare or energy systems.

"This should be a global wake-up call… Across society, we have connected infrastructure operating on the internet that can be attacked. That is the new reality, and we really need measures at national and international level to prevent it; otherwise, this will keep happening," he warned.