Cyberattack on Refrigeration Systems Disrupts Hundreds of French Stores

A cyberattack targeting refrigeration systems affected several hundred stores across France during the night of October 11–12, 2026. By seizing control of cold-regulation equipment, hackers caused abnormal temperature spikes, forcing retailers to discard significant quantities of fresh and frozen products. The incident highlights a major risk for businesses: connected industrial equipment, which is often outdated and inadequately protected, can serve as a gateway to substantial financial losses.

The Scale of the Damage

The extent of the damage exceeds initial reports. Several major retail chains were affected, including Intermarché, Coopérative U, Carrefour, E.Leclerc, and Monoprix. According to Le Monde, some systems were manipulated to raise the temperature of cold rooms to 50 °C (122 °F) and extend defrosting cycles, thereby delaying the detection of the incident. Stores were forced to empty their shelves, suspend certain operations, and organize emergency restocking.

The losses are not limited to the cost of destroyed goods. They may also include technical intervention costs, temporary equipment shutdowns, stock replenishment, and expenses related to damage assessment. At an Intermarché store in Gradignan, merchandise losses were estimated at €21,000 at purchase price. Nationally, the total amount had not yet been established at the time of the initial assessments.

The Entry Point: Outdated Industrial Software

The identified entry point concerns refrigeration regulation software provided by the Danish company Danfoss. The manufacturer explained that the majority of the affected equipment consisted of older generations that had reached the end of their life cycle and no longer received software or security updates. Alerts published in 2025 had already flagged vulnerabilities in some of its software.

However, the issue extends beyond a single brand or an aging IT infrastructure. On October 13, new incidents affected refrigeration systems marketed under the Dixell brand, which are also used in French retail stores. The French National Agency for the Security of Information Systems (ANSSI) confirmed it was aware of compromises affecting these devices. This succession of attacks demonstrates that security measures must cover all connected industrial systems, not just traditional computers and IT servers.

Businesses Must Reassess Connected Device Security

On October 16, CERT-FR, the computer emergency response team attached to ANSSI, issued an alert covering several ranges of Danfoss, Copeland, and Dixell refrigeration controllers. The agency warned that attack campaigns were likely still ongoing. Its recommendations are concrete:

• Remove direct exposure of equipment to the Internet.
• Restrict access to a secure VPN or a protected network.
• Install all available updates.
• Replace default passwords.

For compromised equipment, a simple reset may not be sufficient if the initial vulnerability remains. For executives, this case serves as a reminder that cybersecurity is not solely the responsibility of the IT department. Operations managers, maintenance teams, technical service providers, and suppliers must also be involved. Equipment installed to reduce monitoring costs and facilitate remote maintenance can become a risk factor if it remains connected without appropriate protection.

Therefore, businesses should:

1. Inventory all connected devices.
2. Identify those no longer receiving patches.
3. Verify access granted to service providers.
4. Test business continuity procedures.
5. Review insurance contracts to determine if physical damage, stock destruction, and business interruptions caused by a cyberattack are actually covered.

Ongoing Investigation

The investigation opened by the Paris prosecutor’s office and entrusted to the Anti-Cybercrime Office aims to identify the perpetrators and clarify the circumstances of the intrusions. At this stage, no definitive attribution has been established.