Story summary
Hackers in France launched an unprecedented cyberattack on October 12, 2026, targeting refrigeration systems in hundreds of supermarkets, including chains like Intermarché and Coopérative U. By reprogramming cooling regulators to force a continuous defrost cycle, temperatures inside the fridges soared up to 50°C (122°F) overnight, causing vast amounts of fresh produce, meat, dairy, and frozen goods to spoil.
The attack led to significant financial losses, with individual stores reporting damage in the hundreds of thousands of euros. For instance, two supermarkets in Alsace reported combined losses of €270,000 (£228,000). Authorities confirmed it was a large-scale cyber-attack affecting major food retailers across France and opened an investigation.
The attack highlighted vulnerabilities in third-party systems that manage refrigeration units via internet-accessible control panels, allowing hackers to remotely alter temperatures en masse. French officials are collaborating with European counterparts to assess potential risks for other companies and countries, as similar incidents have been reported in Spain, Portugal, Poland, Germany, and Belgium.
Written for “Cyber Attack On French Supermarkets R…” on 2026-10-13,
grounded in this article and the 6 other(s) covering the same event.
French authorities are investigating after a "large-scale" cyber attack targeted supermarkets and resulted in millions of euros of food wastage.
asserted
attack → investigate → wastage
It raises questions about whether Australian supermarkets could be vulnerable to similar attacks.
uncertain
supermarkets → raise → attacks
What happened to the French supermarkets?
asserted
What → happen → supermarkets
Hackers turned up the temperatures on fridges and freezers in hundreds of stores, spoiling food that had to be discarded.
Les Mousquetaires, owner of retailer Intermarche, said fridges at about 150 of its stores were heated up to 50 degrees Celsius for six hours overnight.
asserted
fridges → turn → hours
Many major supermarkets manage their fridges and freezers by control panels that can be accessed over the internet, allowing maintenance companies to change settings without having to physically enter a store.
"Attackers do not necessarily need to hack individual fridges," University of Queensland's Cyber Research Centre director Ryan Ko says.
asserted
Ko → manage → Queensland
"More commonly, they gain access through compromised credentials, vulnerable remote access services, third-party suppliers, or inadequately secured operational technology management platforms.
asserted
they → gain → credentials
"Once inside, they can potentially change temperature set points across many locations at once."
'Outdated firmware'
asserted
they → change → locations
France's National Cybersecurity Agency (ANSSI) identified a vulnerability in software supplied by Danish company Danfoss, a source close to French Prime Minister Sebastien Lecornu told Reuters.
asserted
source → identify → Reuters
Danfoss said it was "aware of incidents in France affecting a limited number of refrigeration management systems".
asserted
it → say → systems
The company said the affected units "were running outdated firmware".
asserted
units → say → firmware
Danfoss also said it had "long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions".
asserted
systems → say → solutions
In August, cybersecurity firm Claroty's Team82 published research detailing vulnerabilities in the Danfoss AK-SM 800A controller.
asserted
Team82 → publish → controller
That report detailed software updates released by Danfoss that addressed the vulnerabilities that may have allowed attackers to bypass authentication controls and execute code on compromised devices.
uncertain
attackers → detail → devices
How did it happen?
asserted
it → happen → ?
We don't have the confirmed details of that yet, so we can only speculate.
asserted
we → have → that
Macquarie University cyber security lecturer Jennifer Williams says hackers could have taken advantage of an outdated software system.
uncertain
hackers → say → system
"It could be that there was a vulnerability that was already known with the software, but it wasn't patched because they didn't update it," Dr Williams says.
uncertain
Williams → be → it
"The other possibility is there's something called a zero-day vulnerability, which is there's been zero days that that vulnerability has been made public.
asserted
vulnerability → be → ?
That means that no-one knows about it.
"
asserted
one → mean → it
Even the software providers might not be aware and able to control some of those security vulnerabilities."
We'll find out more about exactly how this happened once the ANSSI investigation wraps up.
uncertain
investigation → control → more
Hundreds of stores were affected.
asserted
Hundreds → affect → stores
At least 300 shops of Intermarche or its Netto brand were targeted, along with over 100 Cooperative U outlets as well as several E Leclerc stores, according to Agence France-Presse.
uncertain
shops → target → Presse
Reuters reported that 80 Carrefour Market stores and 5 per cent of Monoprix stores were also affected.
asserted
stores → report → stores
However, Intermarché chief executive Thierry Cotillard told local media the attack would result in "tens of millions of euros nationwide".
asserted
attack → tell → euros
Could the same thing happen here?
uncertain
thing → happen → ?
It's possible, especially if our supermarkets are using similar systems, Professor Ko says.
asserted
Ko → use → systems
"A likely scenario would involve attackers compromising a retailer's corporate network or a centralised refrigeration management platform, then moving into the operational systems that control refrigeration equipment," he says.
"The incident might initially appear as an equipment fault, but could quickly escalate into food spoilage, store closures, lost inventory, supply chain disruption, and reputational damage.
uncertain
incident → involve → spoilage
But Dr Williams says it's likely Australian supermarkets are on alert in case of "copycat" attacks.
asserted
supermarkets → say → attacks
"They're aware that this is now an exploit [and] they need to do something about it," she says.
"
asserted
she → need → it
It's a little bit of cat and mouse in the sense that the criminals might be out there trying to exploit it but, at the same time, the industry is trying to prevent that from happening.
uncertain
industry → try → that
"
Which supermarkets could be targeted?
uncertain
supermarkets → target → ?
"Places like Woolworths and Coles and Aldi … they're very centralised," Dr Williams says.
asserted
Williams → say → Woolworths
"They might be slightly more vulnerable to that because they're more likely to have those centralised systems.
uncertain
they → have → systems
However, independent stores like IGA could be less vulnerable to the attacks if they're not using a wide-ranging centralised system like the supermarkets.
uncertain
they → use → supermarkets
Professor Ko says Coles or Woolworths would be more attractive targets for cyber criminals because of the wider scope of an attack.
"However, being a target is not the same as being vulnerable," he says.
asserted
he → say → attack
"Larger organisations typically invest significantly in cyber security, monitoring, and incident response capabilities.
asserted
organisations → invest → security
"Smaller retailers and independent operators may have fewer resources dedicated to cyber security and could therefore be more vulnerable to compromise.
uncertain
retailers → have → compromise
"In practice, every organisation connected to digital systems is potentially exposed, regardless of size."
The ABC has contacted Woolworths, Coles, Aldi and IGA for comment.
asserted
ABC → connect → comment
Rahat Masood, a senior lecturer in computer science at the University of New South Wales, says the French incident demonstrates a shift in the cybersecurity threat landscape.
asserted
incident → say → landscape
"Traditionally, when we think about cyber attacks, we think about stolen personal information, ransomware or disrupted websites," Dr Masood says.
asserted
Masood → think → information
…and 9 more, not listed.
The Aporia
