French supermarkets lose millions after cyberattack forces fridges to 50C

Full analysis

Hackers gained remote access to internet-connected refrigeration controls made by Danish manufacturer Danfoss and raised temperatures inside freezers and chilled cases at hundreds of French supermarkets overnight on October 11-12. In some locations the equipment reached 50 degrees Celsius, forcing store staff to discard entire stocks of fresh and frozen goods. Intermarché reported between 150 and 300 of its outlets hit, Coopérative U nearly 100, Carrefour 80, Monoprix about 5 percent of its roughly 490 stores, and E.Leclerc several locations. Paris prosecutors opened an investigation into the large-scale cyberattack after reports of food losses and fires at affected sites.

The affected units were older models whose firmware no longer received security updates. Danfoss stated that it had long advised customers to keep systems current or migrate to newer equipment, and a source close to Prime Minister Sebastien Lecornu said France’s National Cybersecurity Agency had identified the vulnerability in the company’s software. Retail executives described the targeting of equipment essential to the food supply as unprecedented. Dominique Schelcher, chief executive of Coopérative U, wrote on X that the incident was “extremely serious and is unprecedented. It is unacceptable.” Intermarché chief Thierry Cotillard told BFM TV that nationwide losses could reach tens of millions of euros in a single day. One Intermarché store in Haguenau, Bas-Rhin, discarded its entire frozen-food range of around 2,000 product lines at an estimated cost of 50,000 euros; its chilled section lost only about 5 percent of stock because staff acted quickly. In Mirepoix, Ariège, a Super U store saw depleted sections for frozen items, meat, dairy and delicatessen goods. An E.Leclerc outlet nearby lost frozen food plus poultry and cooked meats. Groupement Mousquetaires, owner of Intermarché, said products were removed as quickly as possible and operations were returning to normal, though replenishing hundreds of stores simultaneously could strain distribution centers.

Wholesale meat businesses and the catering supplier Metro also reported problems. The Paris prosecutor’s office confirmed it was examining links between the cyberattack, foodstuff losses and reported fires. Prime Minister Lecornu directed the National Cybersecurity Agency to investigate, and French authorities began coordinating with European counterparts because other countries could be affected. A cybersecurity analyst told Al Jazeera that once a vulnerability exists in internet-connected equipment, attackers can log in remotely and trigger its features; the incident therefore represented a global wake-up call rather than an isolated event.

Coverage of the same facts diverged sharply in the level of operational detail supplied. Connexion France alone reported concrete store-level losses, the 2,000-product discard at the Haguenau Intermarché, the 5 percent chilled-food loss there, and the distribution-center bottleneck that could delay restocking. It also recorded differing expert assessments: one cybersecurity consultant described changing hundreds of devices simultaneously as showing “a certain level of sophistication,” while an ethical hacker called the attack “not that sophisticated” because it exploited an unpatched update. The same outlet noted that Danfoss had recommended firmware updates and migration to next-generation systems, and it quoted a source close to the case estimating industry-wide losses in the several-million-euro range. The AFP-based accounts carried by Daily Sabah, Times of India and Al Jazeera repeated the same retailer statements, the prosecutor’s confirmation and the “unprecedented” label almost verbatim, adding only the temperature figure of 50C, mentions of fires, and in one case a reference to President Macron’s earlier order protecting critical infrastructure from Russian hybrid threats. Al Jazeera further included the European coordination step and an analyst warning that future targets could include energy grids or hospitals. The WDR headline framed the story around possible risk to supermarkets in North Rhine-Westphalia, but the article itself could not be retrieved.

These differences matter because the corroborated facts—remote temperature manipulation to 50C, hundreds of stores affected across named chains, exploitation of outdated Danfoss firmware, an official investigation and losses running to millions of euros—rest on overlapping reporting chains that all trace back to the same retailer statements and prosecutor confirmation. No outlet contradicted any of those core claims. What readers miss when they encounter only the wire versions is the texture that shows how the attack actually played out on the ground: which stores lost what volume of stock, how quickly staff could intervene, and whether the vulnerability was trivial or required coordinated access. That texture comes from French regional reporting and direct company comments that the international outlets did not incorporate.