X-Industry

A major cyber-attack on commercial refrigeration systems across France has left more than 150 supermarkets facing millions of euros in damages after hackers remotely changed fridge temperatures overnight. The incident affected cold-chain control software at branches of Intermarché, E.Leclerc, and Coopérative U, also known as Super U. Instead of switching systems off, the attackers increased temperatures inside refrigerators and freezers at hundreds of sites to as high as 50 degrees Celsius overnight. This remote action caused fires in some units and spoiled large quantities of food. Staff arriving for shifts on Monday 12 October 2026 found that fresh produce, meat, dairy products, and frozen goods had been ruined.

Several locations reported serious inventory losses. One Intermarché store and one E.Leclerc branch in Haguenau, eastern France, together estimated their combined stock damage at €270,000 (£225,000). Security specialists determined that the hackers exploited weaknesses in remote management software produced by cooling systems provider Danfoss.

In expert comment, Thomas Plank, CEO at Tributech, said freezers in 500 French supermarkets obeyed a defrost command for six hours reaching 80°C due to missing checks. He urged zero trust in operational technology by verifying command authenticity and policy compliance at each asset before execution.

“Before any command touches a physical asset, two checks must happen, right where it lands. The first is to ask whether the command is genuine. Did it come from an authorized origin, unaltered, not replayed, not injected by a compromised system along the way? A network connection or a login on an intermediate server proves none of these points. The command itself must carry the proof, and the asset must verify it."

“The second check is whether the command is allowed. Even a genuine command can be wrong; a stolen credential, a careless operator, a faulty AI writeback. A freezer has physics and the defrost command lasts minutes, frozen setpoints, therefore, need to stay below zero. Anything outside that envelope should either be refused or require a second approval. If either check is failed, the command should never execute." he said. “Zero trust in operational technology means not trusting the network, not trusting the server, but verifying every command at the asset, and checking it against policy, before it runs.” Plank concluded. 

The event forms part of a series of cyber-attacks directed at important French systems. In August, intruders accessed the country’s internal tax agency systems and compromised income and property records belonging to 678,000 taxpayers and businesses.

In early 2024, criminals breached third-party payment processors Viamedis and Almerys. The breach exposed personal data of 33 million healthcare policyholders and forced pharmacies across the country to process claims manually for a time.

French law enforcement and the national cyber security agency ANSSI have opened an investigation to establish the source of the supermarket attack.

Dutch supermarket operator Ahold Delhaize, which runs the Netherlands’ largest chain Albert Heijn and maintains significant operations in the United States, reported network security issues. The company took several systems offline as a protective measure.

Its smartphone application informed customers that a cyber security incident prevented grocery deliveries. Online orders account for around 10 percent of sales at Albert Heijn. Physical stores stayed open, and Dutch news agency ANP noted that rival retailers recorded a rise in delivery requests.

No information has confirmed any connection between the French supermarket attack and the difficulties reported by Ahold Delhaize. Ahold ranks as the fourth-largest grocery retailer in the US. Websites for its American brands Stop & Shop, Giant, Hannaford, and Food Lion displayed notices stating that the sites were temporarily unavailable. Reports indicate the perpetrators behind the French supermarket refrigeration attack issued a ransom demand. The group requested €125,000 worth of bread from the affected retailers, an unusual demand that highlights the disruptive nature of the incident.

Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com

Weekly Cyber Intelligence Briefings:

• Reporting: https://www. redskyalliance. org/

• Website: https://www. redskyalliance. com/

• LinkedIn: https://www. linkedin. com/company/64265941

Weekly Cyber Intelligence Briefings:

REDSHORTS - Weekly Cyber Intelligence Briefings

https://attendee.gotowebinar.com/register/5504229295967742989