Cyberattack on French Supermarkets Disrupts Refrigeration Systems, Spoils Perishable Goods
Hackers targeted the refrigeration systems of hundreds of French supermarkets this week, forcing stores to discard large quantities of perishable goods. The attack affected major chains like Intermarché, Super U, and Leclerc, disrupting operations and raising concerns about supply chain vulnerabilities in critical infrastructure.
Editor, Lazyfounder
30 SEC SUMMARY
- Hackers targeted refrigeration systems in hundreds of French supermarkets, causing widespread spoilage of perishable goods like meat, frozen products, and vegetables.
- The attack affected major supermarket chains, including Intermarché, Super U, and Leclerc, with fridges and freezers heating to 50°C for about six hours.
- Danfoss, the Danish company managing the refrigeration systems, is filing a complaint with authorities but has not disclosed how attackers gained access.
- Security researchers previously identified vulnerabilities in Danfoss controllers, though it remains unclear if these were exploited in the attack.
- The incident reflects a growing trend of cyberattacks aimed at operational disruption rather than data theft.
TABLE OF CONTENTS
KEY HIGHLIGHTS
- Hackers breached refrigeration systems in hundreds of French supermarkets, including Intermarché, Super U, and Leclerc, leading to significant spoilage of perishable goods.
- About 150 Intermarché stores were affected, with fridges and freezers heating to 50°C for approximately six hours.
- Danfoss, the Danish company managing the systems, is responsible for filing a complaint but has not revealed the attack vector.
- Claroty’s Team82 researchers identified vulnerabilities in Danfoss controllers, including a hidden login that could grant admin access.
- Thousands of Danfoss controllers are exposed to the internet, though it is unclear if these vulnerabilities were exploited in the attack.
What Happened During the Attack
According to The Next Web, hackers breached the refrigeration systems of hundreds of French supermarkets on Sunday night. The attack caused fridges and freezers to heat to 50°C for approximately six hours, leading to the spoilage of perishable goods such as meat, frozen products, and vegetables.
About 150 Intermarché stores were affected, along with fewer than 100 Coopérative U locations. Some Leclerc stores also reported disruptions, though the exact number remains unclear.
Who Manages the Compromised Systems
The refrigeration systems were managed by Danfoss, a Danish company specializing in refrigeration and industrial controls. Danfoss is responsible for filing a complaint with French authorities regarding the incident. Neither Danfoss nor the affected retailers have disclosed how the attackers gained access to the systems.
Known Vulnerabilities in Danfoss Controllers
In August, Claroty’s Team82 researchers identified security flaws in Danfoss controllers used in supermarkets and cold storage facilities. One vulnerability involved a hidden login that could grant admin access to attackers. Danfoss released a firmware fix for these issues.
Thousands of Danfoss controllers remain exposed to the internet, though it is unclear whether the vulnerabilities flagged by Team82 were exploited in this attack.
Trend of Disruptive Cyberattacks
The attack on French supermarkets aligns with a broader trend of cyberattacks aimed at disrupting operations rather than stealing data. Such incidents increasingly target critical infrastructure, including food supply chains, to maximize economic and social impact.
What this means
Lazyfounder analysis — our interpretation, not reported fact.
This attack underscores the growing threat to operational technology (OT) systems, which are often less secure than traditional IT infrastructure but can have immediate physical consequences. For founders and operators, the incident is a reminder that cybersecurity risks extend beyond data breaches—disruptions to critical systems can lead to financial losses, reputational damage, and even public safety concerns.
The reliance on third-party vendors like Danfoss also highlights the importance of supply chain security. Companies must vet the security practices of their hardware and software providers, particularly when those systems are exposed to the internet. The fact that thousands of Danfoss controllers remain internet-accessible suggests that many operators may not have implemented basic security measures, such as network segmentation or regular vulnerability assessments.
Finally, the attack raises questions about regulatory preparedness. As cyber threats to critical infrastructure grow, governments may introduce stricter requirements for incident reporting, vendor audits, and resilience planning. Companies in sectors like food supply, healthcare, and energy should anticipate these changes and proactively strengthen their defenses.
Key takeaways
- Operational technology (OT) systems, such as refrigeration controllers, are increasingly targeted by cyberattacks, posing risks to supply chains and physical infrastructure.
- Founders and operators should audit third-party hardware and software for vulnerabilities, especially if exposed to the internet.
- Incidents like this highlight the need for robust incident response plans, including clear communication protocols with vendors and authorities.
- Cybersecurity for OT systems requires a distinct approach from IT security, focusing on physical safety and operational continuity.
- Regulatory scrutiny of supply chain security may increase, particularly in sectors critical to public welfare.
FAQ
Which supermarket chains were affected by the cyberattack?
The attack targeted Intermarché, Super U, and Leclerc stores in France. About 150 Intermarché locations and fewer than 100 Coopérative U (Super U) stores were affected, with some Leclerc stores also reporting disruptions.
Could this attack have been prevented?
It is unclear whether the specific vulnerabilities identified by Claroty’s Team82 were exploited, but the incident highlights risks associated with internet-exposed operational technology. Basic security measures, such as network segmentation, regular firmware updates, and vulnerability assessments, could reduce such risks.
What should operators do to protect similar systems?
Operators should audit third-party hardware and software for vulnerabilities, restrict internet access to critical systems, and implement robust incident response plans. Collaborating with vendors to ensure timely security updates is also critical.
Related on Lazyfounder
Sources
- The Next Web · 2026-10-12
Hackers defrost fridges at hundreds of French supermarkets, Bloomberg says
This story is an original summary drafted with AI by Lazyfounder from the reporting listed above and checked by automated validation. Facts are attributed to their original publishers; sections marked as analysis are Lazyfounder's. Where a source is in another language, facts were machine-translated and quotations are reported, not reproduced. Read the original coverage via the links, and see our AI policy and corrections policy.
About the author
Editor, Lazyfounder
Tarun Mottlia edits LazyFounders, covering Indian startups, funding rounds, AI and product launches. Every story on the site is AI-assisted and checked against its cited sources before publication.
More stories by Tarun MottliaGet the LazyFounder Brief
Startup, funding and AI news in a five-minute read. Join the early-access list.
