French supermarket hack spoils food as retailers race to secure cooling

Fresh and frozen food that should have been sold instead had to be thrown away. Across hundreds of French supermarkets, attackers remotely manipulated refrigeration controls overnight, leaving staff to discard spoiled stock and, at some locations, deal with damaged equipment and reported fires. A store director described losing all the store’s fresh and frozen produce. ⁷

For retailers, the immediate task is more demanding than restocking: keep food safely chilled while shutting outsiders out of the controls. France’s cybersecurity agency warned that attack campaigns could still be underway, according to Global News reporting published October 14. The warning is not confirmation of fresh compromises that day, but neither has the danger been declared over. ¹

The clearest chronology places the disruption in the night of Sunday, October 11, into Monday, October 12, 2026. Capital reports that overnight window. Global News’s October 14 account described a Sunday attack, while FRANCE 24’s October 13 report said stores were targeted Monday. Those descriptions can fit the same night; they do not establish separate waves. Exact start and end times remain unknown. ^{28 1 6}

Attackers reportedly changed temperature settings or activated defrost systems while stores were unattended. The takeover of refrigeration controls is better established than the route used to gain access. Investigators have not identified a precise exploited vulnerability, and a breach of a shared supplier platform remains unverified. ^{8 20}

Les Mousquetaires accounts for 300 reportedly affected Intermarché and Netto stores—not 300 stores across all of France. Public Sénat’s breakdown also identifies 80 Carrefour supermarkets, 80 U stores, around 30 Monoprix stores and several E. Leclerc locations without a number. The approximate and missing figures prevent an exact total. ^{28 80}

The national estimates remain unreconciled. On October 13, ABC News Australia estimated about 500 from figures supplied by individual chains; Global News reported at least 350; NBC News put the figure at about 700, roughly 7% of France’s approximately 10,000 supermarkets. Publication times alone do not explain the differences. No reconciled site list or counting method establishes whether the higher estimate reflects broader coverage, additional incidents or another distinction. These figures must not be added together. ^{14 5 4}

CTV News’s October 13 account also named affected stores in Spain, Portugal, Poland, Germany and Belgium. French authorities were reported to be coordinating with European counterparts over similar incidents, but there are no verified country-by-country totals or common intrusion chain. Warnings about possible exposure in Canada and Australia are risk assessments, not reports of attacks there. ^{9 8 1 14}

Reports describe temperatures or settings reaching up to 50°C—the same temperature as 122°F. Some accounts say above 100°F or close to 50°C. More importantly, reporting alternates between a controller’s setting and the temperature inside an appliance. Without site-specific sensor logs and timestamps, none establishes one uniform reading across every store. ABC News relayed an expert’s account of six hours or more of heating at some units; that is not an independently timed duration for all affected equipment. ^{6 7 4 5 13}

The financial damage is substantial but not yet accounted for. FRANCE 24 reported a Paris-suburb supermarket’s €55,000 estimate for spoiled products. NBC relayed Intermarché’s chief executive’s expectation of millions of euros in costs, while Reuters reported retailer projections reaching tens of millions of euros. These are estimates at different scales, not an audited bill. ^{15 3 7}

Dollar-denominated accounts also range from millions to tens of millions, without consistently specifying the currency. They cannot simply be combined with the euro estimates. Equipment damage and interrupted sales may extend the consequences beyond replacing food, but separate verified loss components are unavailable. ^{11 4 7}

Reports of fires make this more than a stock-disposal story. The Paris prosecutor’s office included fires and food losses in its account, but the reporting does not establish a complete fire count, all locations, ignition mechanisms or injury information. Missing injury reports are not proof that nobody was hurt. ⁴³

CERT-FR’s alert, CERTFR-2026-ALE-012, was first issued October 12 and revised October 13. Its reproduced text names Danfoss AK-SM and AK-SC controllers, Copeland XWEB and Dixell XWEB systems; Claroty reports that the October 13 revision expanded the named equipment to Copeland and Dixell. Naming these families does not establish that every model or installation is vulnerable in the same way. ^{36 37 38}

The reproduced advisory warns that exposing a management interface to the internet is generally contrary to good practice. Its instructions for equipment not compromised begin with removing internet exposure. That means closing exposed remote management—not an established instruction to switch off refrigeration. The complete procedures for compromised and uncompromised equipment are unavailable here, so a verified sequence of password changes, firmware work and reporting steps cannot be prescribed from this evidence. ^{37 39}

At least one store director told FRANCE 24 that the store had disabled remote operation of its cold units to reduce the risk of another attack. That is a concrete response, not proof that attackers have been excluded everywhere. Some fresh and frozen aisles remained closed during the reporting, with no common reopening date established. ^{15 12}

Danfoss said most affected units belonged to an old product line that had reached the end of its life cycle and no longer received software or security updates, or were running outdated firmware. Later ABC reporting described newer models as unaffected and said the company was assisting customers. Those statements narrow the reported exposure; they are not an independently verified inventory of every affected model. ^{15 3 2}

Professor Ryan Ko, director of the University of Queensland’s Cyber Research Centre, described exposed remote-management systems as a route for attackers to find and manipulate refrigeration controls. Marta Rybczynska, a cybersecurity expert at Ygreky interviewed by FRANCE 24, likewise emphasized internet-accessible administration and years-old firmware. Their assessments explain the risk without establishing the entry method at each store. ^{59 10 49 6}

UNSW professor Richard Buckland suggested that a compromised central provider might explain the multi-retailer disruption. That remains a hypothesis. His recommendation for independent alarms and human oversight addresses a deeper problem: operators need a way to detect dangerous changes that does not depend entirely on the controller being manipulated. Ko’s separate warning that AI can accelerate exploit development is general analysis; no evidence establishes AI use in this attack. ^{61 14 10}

Through the available October 14 reporting, no group had publicly claimed responsibility. No data theft or ransom demand had been reported in accounts addressing those questions; that is not a forensic finding that neither occurred. ^{6 8}

The facts already show why treating refrigeration security as an optional computer expense is untenable. These controls protect a physical necessity. Recovery requires more than a working cabinet: retailers must establish that food is safe and that an outsider cannot change the conditions keeping it that way.

Broadcast reporting: Global News ^{1 5}; ABC News ^{2 11 13}; NBC News ^{3 4}; FRANCE 24 English ^{6 15}; Reuters ⁷; CBS News ⁸; CTV News ⁹; ABC News Australia ^{10 14}; Bloomberg Television ¹²; Guardian News ¹⁶.

Incident and technical coverage: The Hack Academy ¹⁷; Cybernews ¹⁸; Claroty ^{19 38}; TSN Media ²⁰; Food Tech Insider ²¹; Flawfence ²²; CBS News ²³; Time ²⁴; Le Nouvel Obs ²⁵; P.K. Sharma ²⁶.

Retailer and food-industry coverage: Associated Press ²⁷; Capital ²⁸; ABC News Australia ²⁹; FoodNavigator ³⁰; Pollar ³¹; Industrial Cyber ³²; Al Jazeera ³³; Threatcluster ³⁴; The Connexion ³⁵.

Advisory and further reporting: CERT-FR ^{36 81}; Vulnerability-Lookup reproduction ³⁷; CyberTechEdition ³⁹; Security.io ⁴⁰; AIGYROS GROUP ⁴¹; FRANCE 24 ⁴²; NBC News ⁴³; CBC News ⁴⁴; CNBC ⁴⁵; Al Jazeera ⁴⁶; Y94 ⁴⁷; Insurance Business ⁴⁸.

Expert interviews and analysis: FRANCE 24 ⁴⁹; CBC News ⁵⁰; iTnews ⁵¹; Al Jazeera ⁵²; ABC News Australia ⁵³; Auslume ⁵⁴; Globalsconflicts ⁵⁵; Tim McAllister ⁵⁶; Securitysignal ⁵⁷; Duke FM ⁵⁸.

Identity references: University of Queensland profiles, directories and teams ^{59 60 62 63 64 66 67 68}; UNSW profile ⁶¹; Richard Buckland’s LinkedIn profile ⁶⁵.

Policy references: European Commission ⁶⁹; EUR-Lex regulation and PDF ^{70 71}; CRA Evidence ⁷²; Phinasoft ⁷³; Cybernova Labs ⁷⁴; Cyber Resilience Act Explained ⁷⁵; EUVerify ⁷⁶; NISD2.eu ⁷⁷; INNOSYS ⁷⁸.

Additional incident references: Gridinsoft ⁷⁹; Public Sénat ⁸⁰; Maître Reda Kohen ⁸²; Cybernova Labs ⁸³.