Cyberattack Hits Hundreds of Supermarket Refrigeration Systems in France

A coordinated cyber‑attack on a Danish refrigeration‑management platform has disrupted the cold‑chain operations of more than 400 French supermarkets, prompting a wave of product losses and raising fresh concerns about the vulnerability of critical supply‑chain infrastructure. The intrusion, which began early on Monday, targeted the software that monitors and controls temperature settings across a network of refrigerated units, from walk‑in freezers to display cases. As the malware altered sensor readings and disabled automatic alerts, several stores were forced to shut down their cold rooms, resulting in the disposal of perishable goods worth millions of euros..

While the perpetrators remain unidentified, the incident has sparked an immediate response from industry regulators, cybersecurity agencies and the retailers themselves, highlighting the growing intersection of digital threats and everyday commerce.The affected software, developed by a Danish firm that supplies a cloud‑based platform to grocery chains across Europe, is designed to optimise energy consumption and ensure compliance with food‑safety standards. By aggregating data from hundreds of temperature probes and issuing real‑time adjustments, the system has become a backbone of modern retail logistics. In France, the platform underpins the refrigeration networks of three of the country’s largest supermarket groups, collectively operating more than 1,500 stores..

When the breach unfolded, the malicious code injected into the system corrupted temperature logs, prevented alarms from triggering, and, in some cases, caused compressors to run at unsafe levels. Store managers reported erratic temperature fluctuations that could not be rectified through manual overrides, prompting them to isolate the affected units as a precautionary measure.Initial assessments by the retailers indicate that around 30 per cent of the compromised sites experienced a full loss of refrigeration for periods ranging from a few hours to more than a day. In the most severely impacted locations, frozen meat, seafood and ready‑made meals had to be discarded in accordance with health regulations, leading to an estimated waste of €12‑15 million across the network..

For smaller outlets, the financial hit was proportionally less but still significant, with some managers describing the situation as “a nightmare” that disrupted daily operations and strained staff resources. The waste also raised environmental concerns, as the discarded food added to landfill volumes and contributed to the sector’s carbon footprint, underscoring the broader implications of cyber‑induced supply‑chain failures.The French government’s cybersecurity agency, the Agence nationale de la sécurité des systèmes d’information (ANSSI), was immediately alerted and deployed a rapid‑response team to investigate the breach. In a press briefing on Tuesday, ANSSI chief Marie‑Claire Durand stressed that the attack appeared to be highly sophisticated, involving a multi‑stage intrusion that bypassed conventional perimeter defenses..

“We are dealing with a threat actor that possesses deep knowledge of industrial control systems and has tailored the payload to manipulate specific operational parameters,” she said. While ANSSI has not publicly named any suspects, the agency is collaborating with law enforcement, the Danish software provider and the affected supermarket chains to trace the digital fingerprints left by the malware. Early forensic analysis points to a possible exploitation of a previously unknown vulnerability in the platform’s communication protocol, which allowed the attackers to gain privileged access without triggering standard intrusion‑detection mechanisms.The Danish vendor, whose name has been withheld pending a formal statement, confirmed that it became aware of the incident after receiving alerts from several of its French clients..

In a written response, the company expressed regret for the disruption and pledged full cooperation with investigators. It also announced that an emergency patch would be rolled out to all customers within 48 hours, alongside a comprehensive audit of the platform’s codebase. “Our priority is to restore the integrity of our services and to ensure that such a breach cannot happen again,” the statement read..

The vendor has a longstanding reputation for robust security practices, having previously earned certifications under the ISO/IEC 27001 standard, but the attack has revealed that even well‑established systems can harbor hidden weaknesses, especially when they integrate legacy hardware with modern cloud services.Retailers affected by the outage have taken a range of remedial actions to mitigate further loss. In addition to deploying temporary portable freezers and sourcing backup generators, some stores reverted to manual temperature logging, a labor‑intensive process that had been largely automated for years. Employees were instructed to perform frequent visual inspections of perishable goods and to document any temperature deviations in paper logs, a step that regulators say is essential for traceability in the event of a food‑safety investigation..

The French Ministry of Agriculture, which oversees food‑safety compliance, has temporarily suspended routine inspections for the affected outlets, allowing them to focus on stabilising operations. However, it has warned that any violations discovered during the remediation period could result in fines or temporary closures.Industry analysts see the incident as a wake‑up call for the retail sector, which has increasingly embraced digital tools to optimise inventory, reduce waste and lower energy costs. “The convergence of operational technology and IT creates a larger attack surface,” noted Claire Lefevre, a senior analyst at EuroRetail Insights..

“Supermarkets are now dependent on software that controls physical assets, and a breach of that software can translate directly into product loss, reputational damage and regulatory scrutiny.” She added that the event could accelerate a shift toward more resilient architectures, including the adoption of segmented networks, redundant control systems and regular penetration testing of industrial control environments. Some experts also suggest that insurers may begin to adjust premiums for grocery chains, factoring in cyber‑risk exposure alongside traditional perils such as fire or theft.The broader European context underscores the growing relevance of cyber resilience in food supply chains. In recent months, several high‑profile attacks on logistics firms, agricultural equipment manufacturers and food‑processing plants have demonstrated that malicious actors are targeting the “last mile” of distribution..

While some incidents have been attributed to financially motivated ransomware groups, others appear to be the work of state‑aligned actors seeking to disrupt critical infrastructure. French authorities have previously warned that the country’s heavy reliance on digital platforms for essential services makes it a prime target for hostile cyber activities. In response, the government has launched a national initiative, “Cyber‑Secure Supply Chain,” aimed at establishing mandatory security standards for vendors that provide operational technology to critical sectors, including retail.Consumer confidence has been tested by the episode, with social media platforms buzzing with reports of empty freezer aisles and frustrated shoppers..

A poll conducted by a leading French market research firm indicated that 42 per cent of respondents expressed heightened concern about the safety of food products after a cyber‑attack, while 31 per cent said they might consider shopping at smaller, locally owned stores perceived to be less reliant on complex digital systems. Supermarket chains have launched.