Key points
- French prosecutors described the attack on supermarket refrigeration systems as large-scale.
- Danfoss attributed the incidents to outdated firmware in its refrigeration management systems.
- Affected chains include Intermarche, Carrefour, Monoprix, and potentially others in Europe.
The short version
- Unknown hackers remotely increased thermostat settings on refrigeration units across France.
- Temperatures in some units reached 122 degrees Fahrenheit, leading to food waste and fires.
- The attack originated from a vulnerability in Danfoss engineering equipment, per ANSSI.
The details
Unknown attackers breached hundreds of supermarkets across France this weekend, according to French authorities speaking to Reuters. The intruders remotely adjusted thermostats on refrigerators and freezers, raising temperatures to as high as 122 degrees Fahrenheit (50 degrees Celsius). Paris prosecutors characterized the incident as a large-scale attack. The immediate consequences included significant food spoilage and, in some cases, fires. The full extent of the damage remains unclear, but Intermarche CEO Thierry Cotillard estimated losses could reach tens of millions of euros, according to Reuters.
Danfoss, a Danish engineering firm, stated it is aware of incidents affecting a limited number of its refrigeration management systems in France. The company told reporters that the root cause was outdated firmware. France’s National Cybersecurity Agency (ANSSI) is investigating the breach. A source with Prime Minister Sebastien Lecornu’s office told Reuters that ANSSI already found signs the attack originated with a vulnerability at Danfoss.
Reuters identified several confirmed targets, including Les Mousquetaires, which owns Intermarche, with 150 stores affected. Carrefour reported 80 impacted stores. Monoprix saw around 5% of its 490 French stores, or roughly 25 locations, affected. The status of Cooperative U remains unclear. Felix Aime, a senior cyber intelligence threat analyst at Sekoia Threat Detection and Research, told the news agency that organizations in Spain, Portugal, Poland, Germany, and Belgium also appeared to be hit.
The context
Operational technology systems connected to the internet were often not designed with security in mind, according to the report. Disabling equipment to cause costly downtime is a common tactic for ransomware gangs and other threat actors. Targeting the retail sector is far from uncommon. An attack on UK retailer Marks & Spencer last year shuttered stores and caused £324 million in lost sales, according to the source material. That incident was part of a spree that eventually snared brands like Harrod’s.
Data from Infor, cited by Food Navigator, indicates that attacks on the food and beverage industries are growing. The number of ransomware victims forced to halt operations rose from 45% in 2021 to 58% in 2025. Threat actors are becoming more effective at forcing organizations to shut down. That suggests operational technology vulnerabilities are an increasing pressure point for cybercriminals targeting retail supply chains.
What to watch
Monitor official statements from Danfoss for updates on the specific firmware versions affected. Watch for advisories from national cybersecurity agencies like ANSSI regarding similar threats in Europe. Retailers should review their operational technology network segmentation to limit remote access. Security teams should audit older firmware versions on critical infrastructure for known vulnerabilities.
Background: Supply chain attacks
A supply chain attack targets the software or hardware you use before it reaches you. By compromising a trusted vendor, attackers insert malicious code that installs automatically on your systems when you update or deploy the product. This bypasses perimeter defenses because the malicious payload arrives with a valid digital signature.
Read the full guide: Supply Chain Attacks: How Trust Becomes Your Biggest Security Risk
What to do and how to stay safe: Danfoss
- Audit your operational technology devices for outdated firmware versions that may contain known vulnerabilities.
- Segment your industrial control networks from general corporate IT networks to limit remote access.
- Monitor system logs for unusual temperature changes or unauthorized configuration adjustments in cooling systems.
- Ensure your incident response plan includes procedures for physical safety hazards like fires or spoiled inventory.
Step-by-step guide: Secure Home Routers for Small Business Networks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific supermarket chains were confirmed as targets?
Reuters confirmed targets include Intermarche (150 stores), Carrefour (80 stores), and Monoprix (around 25 stores).
Did the attack affect stores outside of France?
Analysts reported that organizations in Spain, Portugal, Poland, Germany, and Belgium also appeared to be hit.
What caused the vulnerability in the refrigeration systems?
Danfoss stated that the root cause of the incidents was outdated firmware in its management systems.
