Six days after hackers hijacked refrigeration systems inside hundreds of French supermarkets, nobody has claimed responsibility, and the country’s cybersecurity authority says the attack may not even be over. Stores that spent the week throwing out spoiled meat, dairy, and frozen goods are now being told to proceed carefully: reconnect refrigeration units only through a secure VPN or protected network, patch firmware, and change every password before plugging equipment back into the network.
The warning, reported by Insurance Journal on October 16, 2026, turns what looked like a contained incident into an open-ended security problem for one of Europe’s largest grocery markets. French Finance Minister Roland Lescure told Parliament that roughly 700 of the country’s 10,000 supermarkets were hit. The Paris prosecutor’s office has opened a cybercrime investigation. And as of this week, investigators still do not know who did it, or whether the intrusion has actually been shut down.
What Happened: A Cyberattack on France’s Cold Chain
The attack struck in the early hours of Monday, October 12, 2026, remotely seizing control of refrigeration systems at supermarkets and independent grocery stores across France. Rather than locking up point-of-sale terminals or encrypting back-office servers, the intruders went after a part of retail infrastructure that rarely gets executive attention: the industrial controllers that keep walk-in coolers and freezer cases at safe temperatures.
According to AP News, the affected systems are the kind of networked building-management hardware that large retail chains use to centrally monitor and adjust cooling across hundreds of locations at once. That centralization is normally a convenience. On October 12, it became the attack surface. Once inside, whoever was responsible pushed refrigeration units to abnormal temperatures, in some cases as high as 50°C (122°F), effectively defrosting coolers meant to hold food several degrees above freezing.
By the time staff at affected stores noticed, the damage to perishable inventory was often already done. Retailers had little choice but to discard fresh and frozen stock rather than risk selling food that had sat outside safe temperature ranges, even if only for a few hours.
Six Hours at 50°C: Inside the Cold Chain Failure
Groupement Mousquetaires, which owns the Intermarché and Netto brands, gave one of the clearest pictures of how long the damage lasted. The company told the BBC that refrigeration units at some of its stores sat at the elevated 50°C mark for six hours overnight, long enough to spoil everything inside. For a supermarket chain, six hours is not a glitch, it is an entire overnight shift during which an unmonitored system can quietly destroy an entire category of inventory.
Food safety rules exist precisely because the cold chain, the unbroken sequence of refrigeration from processing plant to store shelf, cannot tolerate gaps. A six-hour thermal excursion overnight, discovered only the next morning, leaves retailers with one option: write off the stock. Multiply that across hundreds of stores and the scale of the loss becomes obvious, even without a confirmed euro figure attached to it yet.
Why Refrigeration Systems Are a Soft Target
Industrial refrigeration controllers sit in a category security researchers have long flagged as under-protected: operational technology, or OT, that was built for reliability on a closed network decades ago and later connected to the internet for remote monitoring, without a matching upgrade in authentication or network segmentation. Retail chains added that connectivity so regional managers could watch temperatures across a chain from a single dashboard. The tradeoff, now playing out across France, is that a single compromised credential or an exposed management interface can give an attacker the same centralized reach.
The Toll by Retailer: Carrefour, Intermarché, Coopérative U
The 700-store national figure cited by Lescure is an aggregate. Individual retailers have given their own numbers, and the proportional impact varies sharply by chain. Carrefour, one of France’s largest grocery groups, said the incident primarily affected 80 of its roughly 6,000 stores, a small fraction of its total footprint. Dominique Schelcher, chief executive of Coopérative U, said 80 of the company’s 2,000 stores were hit, a proportionally much larger share. Groupement Mousquetaires reported the heaviest absolute impact, with 300 of its Intermarché and Netto locations affected.
Those three retailers alone account for 460 of the 700 stores Lescure referenced in Parliament, meaning the remaining 240 are spread across other supermarket groups and independent stores that have not yet put individual numbers on the record. That gap is itself informative: six days in, the French government has a national estimate, but a full retailer-by-retailer accounting still has not been published.
Why Authorities Say the Attack May Still Be Ongoing
The most unsettling detail to emerge this week is not the scale of the damage already done, it is the possibility that the intrusion was never fully closed. France’s cybersecurity authority said the attacks were likely still underway, a warning that landed as retailers were trying to get refrigeration back online and resume normal restocking.
That guidance reframes the incident from a one-time disruption into an active threat that store operators have to manage in real time. The authority’s advisory was specific: affected stores should reconnect refrigerators only through a secure VPN connection or a protected network, install firmware updates on the controllers, and change passwords before bringing systems back online. Each instruction maps directly to how the attackers likely got in, through exposed or weakly authenticated remote-management interfaces, and signals that the agency is not confident the original access point has been fully sealed off at every affected site.
Restocking Paused: Intermarché’s Reconnection Order
Intermarché took the warning seriously enough to issue its own internal instruction: affected stores should not reconnect refrigeration systems to the network while restocking efforts continued. That is a notable operational call for a grocery chain in the middle of replacing spoiled inventory. Running coolers without centralized network monitoring means store staff have to manually check temperatures rather than relying on the dashboards that made the original attack possible in the first place, a slower and more labor-intensive process, but a safer one until the chain’s IT and security teams can confirm the network is clean.
The decision illustrates the bind retailers are in. Reconnecting too quickly risks a repeat incident on equipment that was never fully cleared. Staying offline too long extends the restocking delay and the associated losses. For an industry built on thin margins and fast-moving perishable inventory, neither option is comfortable, which is precisely why the government’s advisory landed as unwelcome news rather than reassurance.
Paris Prosecutors Open a Cybercrime Investigation
The Paris prosecutor’s office has opened an investigation through its cybercrime unit, a step that moves the case from a corporate IT incident into a formal criminal matter. The inquiry’s scope reportedly covers both the direct financial losses from spoiled food and reported fires linked to the incident, broadening the investigation beyond the refrigeration hack itself into its physical consequences.
A formal cybercrime probe gives French authorities subpoena power and forensic resources that individual retailers do not have on their own, and it signals that the state views the incident as a national security matter rather than a private-sector cleanup job. It also means any eventual attribution, if investigators identify who was behind the intrusion, will carry legal weight rather than remaining speculation.
No Claim of Responsibility: The Attribution Vacuum
Six days on, no group or individual has claimed responsibility for the attack. That silence is unusual by the standards of recent ransomware and extortion incidents, where criminal groups typically post claims quickly to pressure victims into paying or to build their own reputation. A refrigeration-focused attack with no ransom demand and no public claim suggests either a motive other than financial extortion, a deliberate effort to stay anonymous, or simply that the operation has not reached whatever stage was supposed to trigger a public statement.
Whatever the explanation, the lack of attribution leaves retailers across France, and arguably across any country running similar networked refrigeration infrastructure, without a clear adversary to defend against. Security teams can patch the specific systems identified in this incident, but without knowing who carried out the attack or what tools they used beyond the refrigeration controllers themselves, other operators cannot be certain whether they face the same exposure.
Market Impact: Losses Still Unconfirmed
The exact financial toll of the attack remains unknown. Reported estimates range from several million euros to potentially tens of millions, but no single confirmed total has been published by the French government or by the retailers involved. That range reflects the difficulty of tallying losses across hundreds of individually affected stores, each with its own inventory mix, insurance coverage, and restocking timeline, while the investigation and recovery are still in progress.
Lescure told Parliament there was no risk to France’s broader food supply, but he was direct about the stakes, saying the attack touches the heart of our food security. That framing elevates a refrigeration outage from a retail inconvenience to a question of critical infrastructure resilience, language usually reserved for attacks on power grids, water systems, or fuel pipelines rather than grocery store coolers.
Insurance and Retailer Exposure
With losses still unconfirmed, insurers covering the affected chains face their own uncertainty window. Cyber insurance policies written for retail operators typically separate data-breach coverage from physical-damage or business-interruption coverage, and an OT-triggered spoilage event like this one may test how cleanly those policy categories map onto a refrigeration hack that caused real, physical food loss rather than a data leak. Until the prosecutor’s office and the retailers themselves put a confirmed number on the losses, claims adjusters are working from the same range of estimates everyone else has: several million euros on the low end, tens of millions on the high end.
Competitive Comparison: How the Big Three Retailers Stack Up
Looking at the proportion of each retailer’s network affected, rather than just the raw store counts, tells a different story than the headline 700-store figure. Coopérative U’s 80 affected stores represent 4% of its 2,000-store network, the highest proportional hit among the three major chains that have disclosed numbers. Groupement Mousquetaires’ 300 affected Intermarché and Netto locations are the largest absolute number, but without a disclosed total store count for that comparison, the proportional impact cannot be calculated the same way. Carrefour’s 80 affected stores out of roughly 6,000 amount to about 1.3%, the smallest proportional exposure of the three.
That spread suggests the attack’s reach was not uniform across retailers, possibly reflecting differences in which refrigeration vendors or network architectures each chain uses, though none of the retailers have published technical detail confirming that link. It also means any retailer, large or small, evaluating its own exposure cannot simply look at Carrefour’s relatively contained 1.3% and assume the risk is low across the industry.
Store Impact by Retailer
| Retailer | Stores Affected | Total Network Size | Proportional Impact |
|---|---|---|---|
| Groupement Mousquetaires (Intermarché, Netto) | 300 | Not disclosed | Not calculable |
| Carrefour | 80 | ~6,000 | ~1.3% |
| Coopérative U | 80 | 2,000 | 4% |
| Other chains and independents (remainder) | ~240 | Not disclosed | Not calculable |
| National total (government estimate) | 700 | 10,000 | 7% |
Timeline of the Attack and Response
| Date | Event |
|---|---|
| Oct 12, 2026 (early hours) | Attackers remotely take control of refrigeration systems at supermarkets and independent stores nationwide |
| Oct 12-13, 2026 | Affected stores discover spoiled stock; some units reach 50°C for up to six hours overnight |
| Oct 13, 2026 | Finance Minister Roland Lescure tells Parliament ~700 of 10,000 supermarkets affected; Paris prosecutor’s cybercrime unit opens an investigation |
| Oct 14, 2026 | France’s cybersecurity authority warns the attack may still be underway as stores begin restocking |
| Oct 16, 2026 | Insurance Journal reports the ongoing-threat warning and VPN-only reconnection guidance |
| Oct 18, 2026 | No group has claimed responsibility; confirmed financial losses remain unpublished |
Historical Context: Food Supply Chains as a Cyber Target
Grocery retail has not traditionally been treated as critical infrastructure in the way power grids, water utilities, or telecommunications networks are. This incident is likely to accelerate a rethink of that assumption. Security researchers have warned for years that operational technology, the industrial controllers running refrigeration, HVAC, and building management systems, tends to lag years behind IT systems in basic protections like network segmentation, multi-factor authentication, and timely firmware patching, largely because these systems were designed for decades-long reliability rather than for a connected, internet-facing environment.
What makes the French incident distinctive is the directness of the physical consequence. A compromised refrigeration controller does not just risk data exposure, it risks the literal spoilage of food at a national scale within hours, with no way to reverse the damage once the cold chain breaks. That immediacy, and the fact that it reached a government minister’s testimony to Parliament, suggests OT security in retail is likely to get a level of regulatory and public attention it has not previously received in France or, potentially, in other European markets watching how this plays out.
What Comes Next: Five Predictions
- Expect French and EU regulators to push for mandatory OT security audits across large retail chains, given that a government minister has already linked the incident to national food security.
- Other European grocery chains running similar networked refrigeration or building-management systems are likely to run emergency security reviews of their own vendor relationships in the coming weeks, even absent a public claim of responsibility.
- Cyber insurers covering retail operators will likely revisit how OT-triggered physical losses, as opposed to data breaches, are classified and covered, given the ambiguity this incident has exposed.
- If the Paris prosecutor’s cybercrime unit identifies a suspect or group, expect significant international attention given the rarity of attacks that target food supply infrastructure this directly.
- Confirmed financial loss figures, once published, are likely to land toward the higher end of the “several million to tens of millions of euros” range reported so far, given the number of stores and the multi-hour spoilage windows already documented.
What Retailers Elsewhere Should Take From This
For grocery and retail operators outside France, the practical lesson sits in the specific guidance French authorities gave affected stores: reconnect only through a secure VPN or protected network, patch firmware before bringing systems back online, and rotate every password tied to the affected equipment. Those three steps are not exotic, they are standard OT hardening practice that has existed for years, but this incident is a reminder that standard practice and actual deployed practice are often two different things once refrigeration vendors, store IT teams, and corporate security sit in separate organizational silos.
The attack also underscores a point that cybersecurity teams have made for years about centralized monitoring systems: the same dashboard that lets a regional manager adjust cooling across 300 stores from one login is the same dashboard an attacker only needs to compromise once to reach all 300. Centralization is efficient until it becomes a single point of failure, and retailers evaluating their own refrigeration networks this week are almost certainly asking how many stores a single compromised credential could reach in their own operation.
Frequently Asked Questions
Is the French supermarket cyberattack over?
Not confirmed. France’s cybersecurity authority said as of mid-October that the attack was likely still underway, which is why it told stores to reconnect refrigeration systems only through a secure VPN or protected network rather than resuming normal connectivity.
How many French supermarkets were affected by the fridge hack?
French Finance Minister Roland Lescure told Parliament that about 700 of France’s 10,000 supermarkets were affected. Individual chains reported their own counts: Groupement Mousquetaires said 300 Intermarché and Netto stores, Carrefour said 80 of its roughly 6,000 stores, and Coopérative U said 80 of its 2,000 stores.
Who is responsible for the French supermarket refrigeration hack?
No group or individual has claimed responsibility as of this report. The Paris prosecutor’s office has opened an investigation through its cybercrime unit, but attribution has not been publicly established.
How hot did the refrigeration units get during the attack?
Some refrigeration units reached as high as 50°C (122°F). Intermarché said affected units stayed at that temperature for six hours overnight, long enough to spoil the perishable stock inside.
Is France’s food supply at risk because of the attack?
Finance Minister Roland Lescure said there was no risk to France’s overall food supplies, though he described the incident as touching the heart of the country’s food security, reflecting the seriousness with which the government is treating the incident despite the contained national risk.
What should other retailers do in response to this attack?
The guidance French authorities gave affected stores applies broadly: reconnect industrial control and refrigeration systems only through a secure VPN or protected network, install the latest firmware updates, and change all associated passwords before restoring full connectivity.
How much money has the attack cost French retailers?
The total financial loss has not been confirmed. Reported estimates range from several million euros to potentially tens of millions, but no official total has been published by the government or the affected retailers.
Were there any fires linked to the cyberattack?
The Paris prosecutor’s cybercrime investigation reportedly covers reported fires linked to the incident, in addition to the financial losses from spoiled food, though further details on the fires have not been independently confirmed.