Refrigeration control systems at hundreds of supermarkets across France were accessed without authorisation, causing unit temperatures to climb to around 50 degrees Celsius overnight — conditions that left stored food damaged and, in certain units, sparked fires. Paris prosecutors disclosed on Monday that internet-connected cooling systems across several of the country's supermarket chains had been targeted in a planned cyber operation, leaving perishable goods unusable and triggering fires at multiple affected stores.
Disruption landed across roughly 80 Carrefour locations, while Monoprix — a chain running close to 490 outlets throughout France — put the share of its own affected branches at around one in twenty. Refrigeration units across roughly 150 Intermarché locations were brought up to 50 degrees Celsius for a six-hour period during the night, according to a statement from Les Mousquetaires, the group that operates the supermarket chain. The statement from a company representative indicated that any implicated food items had been removed from circulation, with disposal carried out as a precautionary measure against potential health concerns.
Dominique Schelcher, who leads Cooperative U, used a post on X to confirm that his supermarket group was among those hit, noting that targeting the refrigeration infrastructure and food distribution network serving the public represented an act of a severity not encountered before. Neither E.Leclerc nor Auchan, both food retail chains, provided a reply when approached for comment.
According to Felix Aime, a threat intelligence analyst at Sekoia's detection and research division, the disruption extended to five additional countries — Spain, Portugal, Poland, Germany, and Belgium.
Figures on sector-wide financial damage had yet to be confirmed, though Intermarché chief executive Thierry Cotillard told a broadcaster that the attack — which he described as without precedent — stood to drain tens of millions of euros from retailers across the country within a single day. Christel Delberghe, director general at the European retail body Eurocommerce, noted that the episode pointed to the need for stronger resilience throughout supply chains, a vulnerability rooted in how supermarket cold-aisle control panels, which govern all refrigeration and freezer units in a given store, are routinely connected to the internet so that maintenance contractors can make adjustments from off-site.
According to a person with knowledge of Lecornu's inner circle, ANSSI traced a security flaw back to software delivered by Danfoss, a company based in Denmark. The prime minister's office indicated that Lecornu had directed France's National Cybersecurity Agency, known as ANSSI, to open an investigation into the matter. Coordination with European partners was under way, the source noted, given that the exposure could extend beyond one country's borders, while domestic investigators were simultaneously working to determine whether additional French firms faced comparable vulnerabilities.
Danfoss disclosed that a limited set of refrigeration management systems in France had been touched by incidents, attributing the affected units' exposure to outdated firmware and pointing to longstanding company guidance urging customers to apply current firmware updates and transition legacy equipment to newer-generation platforms. Separately, on 9 August, Team82 — the research arm of cybersecurity firm Claroty — released findings detailing vulnerabilities within the Danfoss AK-SM 800A controller. Patches pushed out by Danfoss closed off vulnerabilities that would have allowed unauthorised parties to sidestep login protections and run arbitrary code on affected hardware.
Patterns of interference matching those documented across roughly twelve US military commissaries in the final days of August — incidents that left refrigeration units compromised and food stocks spoiled — appear to run parallel to the current disruptions.
The French retail body Fédération du Commerce et de la Distribution issued a public statement pressing Danfoss to be fully open about what had taken place. Grocery retailers, the statement indicated, were working to shield shoppers from disruption while moving toward a restoration of regular trading conditions. A number of affected locations had already resumed normal operations, the FCD noted.
Ahold Delhaize — the Dutch retail group behind Albert Heijn, the Netherlands' biggest grocery chain, and a broad portfolio of US operations — disclosed that a network-level security problem had prompted it to take a number of internal systems offline as a precautionary measure. Notifications pushed through the retailer's app told customers that grocery deliveries had been halted due to what the company described as a cybersecurity incident, with digital orders representing roughly a tenth of Albert Heijn's total revenue. Brick-and-mortar locations stayed in operation throughout, and ANP, the Dutch news agency, noted that competing retailers were handling a noticeable uptick in home delivery requests. The retailer's representatives drew no connection between the French incidents and its supermarket operations.
Ranked among the top five grocery retailers operating across the United States, Ahold holds the fourth position by that measure. Online pages for Stop & Shop, Giant, Hannaford, and Food Lion all carried notices that the respective sites were down for the time being, while the extent of any broader disruption across other parts of the business remained unknown.
