A cyberattack affecting approximately 700 supermarkets in France has exposed serious weaknesses in the digital systems used to control commercial refrigeration, raising concerns about the vulnerability of European food distribution networks and other essential infrastructure.
The attack began overnight on 11–12th October, when intruders gained access to remotely managed refrigeration equipment and altered operating settings, causing refrigerators and freezers to overheat.
Stores belonging to several major supermarket chains were affected, including Intermarché, Netto, Coopérative U, Carrefour and Monoprix. Some were forced to discard substantial quantities of fresh and frozen food.
French Finance Minister Roland Lescure confirmed that approximately 700 of the country’s 10,000 supermarkets had been affected, although the severity of the disruption varied between locations.
The Paris prosecutor’s office has opened an investigation into the attack, including the damage caused by destroyed merchandise and reported fires.
The incident has drawn attention to industrial control systems that are routinely connected to the internet but may receive less cybersecurity protection than corporate networks and customer databases.
Refrigeration systems remotely manipulated
Investigators have established that refrigeration equipment was targeted through vulnerabilities associated with remote monitoring and control systems.
The French cybersecurity authorities identified compromises involving products supplied by Danish manufacturer Danfoss and American company Copeland.
Some of the affected systems used older equipment that no longer received regular security updates.
According to information released by the companies and cybersecurity specialists, certain industrial controllers had been accessible through public internet connections, creating opportunities for unauthorised access.
Hackers reportedly manipulated defrost cycles and increased temperature settings, preventing equipment from maintaining the cold conditions required to preserve food.
The attack affected approximately 300 Intermarché and Netto stores, while Coopérative U reported disruption at around 80 outlets.
Several retailers managed to contain the damage, but others lost substantial quantities of stock.
The consequences extended beyond malfunctioning equipment. Businesses faced the cost of replacing spoiled food, repairing refrigeration systems and restoring normal operations.
The precise financial damage is still being assessed, although estimates from the retail sector indicate that losses across France could amount to tens of millions of euros.
Vulnerabilities in connected equipment
The incident illustrates the security problems created by the growing use of internet-connected industrial equipment.
Modern refrigeration installations allow contractors and maintenance specialists to monitor temperatures, adjust settings and diagnose faults remotely.
These arrangements can reduce operating costs and improve efficiency, but they also create additional access points that attackers may exploit.
Cybersecurity specialists have identified vulnerabilities in commercial refrigeration platforms manufactured by Danfoss and Copeland.
The manufacturers subsequently addressed identified flaws, although older or unsupported equipment remained a concern.
A critical problem for businesses is that industrial machinery often remains operational for many years after its original software has become obsolete.
Replacing entire refrigeration installations can involve substantial expense and operational disruption, encouraging operators to retain equipment that may no longer meet contemporary cybersecurity standards.
The risks are particularly difficult to manage when responsibility for maintenance, software updates and network security is divided between retailers, equipment suppliers and external contractors.
France’s delayed cybersecurity legislation
The attack has renewed scrutiny of France’s implementation of the European Union’s NIS2 Directive, which is intended to strengthen cybersecurity across sectors providing important economic and public services.
The directive establishes common requirements covering risk management, incident reporting, organisational responsibility and protection against cyber threats.
Its scope extends beyond traditional critical infrastructure such as energy, telecommunications and transport to include certain businesses involved in food production, processing and distribution.
EU member states were required to incorporate the directive into national legislation by 17 October 2024.
France was among the countries that received a formal warning from the European Commission in May 2025 over incomplete implementation.
French cybersecurity specialists have since warned that delays have complicated efforts to establish consistent obligations for organisations operating industrial and commercial systems.
However, NIS2 does not automatically cover every supermarket. Its application depends on the nature and size of an organisation and the provisions of national implementing legislation.
The incident therefore raises questions not only about the pace of legislative implementation but also about the practical protection of equipment already in use.
Wider implications for European infrastructure
The disruption demonstrates how a cyberattack can cause physical damage without directly targeting a conventional industrial facility.
Unlike breaches intended to steal customer information, the French incident interfered with machinery responsible for preserving essential products.
The distinction is important for European policymakers, who increasingly face threats to infrastructure that combines digital controls with physical operations.
The European Union’s cybersecurity agency ENISA has organised cross-border exercises to test how authorities and companies would respond to disruption affecting essential services.
The attack itself has been established, but responsibility for it has not been publicly attributed.
French authorities have said there is no immediate threat to national food supplies. Nevertheless, the destruction of merchandise and interruption of ordinary retail operations have demonstrated the potential economic consequences of weaknesses in relatively commonplace equipment.
The continuing investigation must establish how access was obtained, which systems were compromised and whether the vulnerabilities were known to operators before the attack.
For Brussels and national regulators, the case provides a practical test of whether European cybersecurity legislation can translate into effective protection for the connected equipment on which ordinary commercial activities increasingly depend.
Login
