French supermarket chains spent the week of October 12 throwing out spoiled food, rebooting refrigeration units, and trying to answer a question their own government could not: is the cyberattack that hit their stores actually over? On October 16, 2026, Insurance Journal reported that France’s national cybersecurity authority told retailers the attacks were “likely still underway,” even as hundreds of stores tried to restock shelves and bring cooling systems back online.
That warning complicates what should have been a straightforward cleanup. Supermarkets across France do not just need to replace spoiled stock, they need to figure out whether it is safe to plug their refrigeration systems back into the internet at all. The French cybersecurity authority’s guidance, carried by the Associated Press, was blunt: reconnect refrigerators only through a secure VPN or a protected network, install firmware updates first, and change every password tied to the equipment. For an industry built around keeping food cold around the clock, that is a hard set of conditions to meet while shelves sit empty.
What happened: a cyberattack that targeted refrigeration, not registers
The attack struck in the early hours of Monday, October 12, 2026, remotely seizing control of refrigeration systems at supermarkets and independent grocery stores across France. Unlike a typical retail breach aimed at payment data or loyalty accounts, this one went straight after the machinery that keeps food cold. Refrigeration units at affected stores heated to as high as 50°C (122°F), according to multiple retailers. Intermarché said some of its units sat at that temperature for six hours overnight before staff discovered the problem.
French Finance Minister Roland Lescure told Parliament that roughly 700 of France’s 10,000 supermarkets were affected, a scale that turned an IT problem into a national food-safety story almost overnight. Lescure said there was no risk to France’s broader food supply, but added that the attack “touches the heart of our food security,” a framing that several French officials have repeated since the incident began.
Stores that lost refrigeration had one real option once temperatures climbed past safe thresholds: throw out the stock. Fresh and frozen products across hundreds of locations were discarded to avoid breaking the cold chain and creating a health risk, a decision retailers say was costly but unavoidable. The precise national bill for spoiled inventory has not been settled. Early estimates range from several million euros into the tens of millions, but no single confirmed total has emerged as of October 18.
The retailer-by-retailer toll
What makes this incident unusual is how cleanly the damage splits across France’s major grocery groups, each of which has put its own number on the record rather than letting the national 700-store figure stand alone.
Groupement Mousquetaires, the cooperative behind the Intermarché and Netto banners, said 300 of its stores were hit, the largest single-chain count disclosed so far. Carrefour, France’s largest retailer by store count, said the incident primarily affected 80 of its roughly 6,000 locations nationwide. Dominique Schelcher, chief executive of Coopérative U, said 80 of the company’s 2,000 stores, operating under brands including Hyper U, Super U, U Express, and Utile, were affected as well.
Schelcher has been one of the more visible executives responding publicly to the attack. “Our teams are fully mobilized, in coordination with refrigeration specialists, to restore the situation as quickly as possible,” he said, according to the BBC. In a separate statement carried by PBS NewsHour, Schelcher was more pointed about the nature of the attack itself: “Targeting equipment essential to the preservation of fresh products is an attack on the French food supply chain. It is unprecedented, extremely serious, and unacceptable.”
The table below breaks down the disclosed store counts by chain, as reported through October 18.
| Retail group | Banners affected | Stores hit (disclosed) | Total store network | Share affected |
|---|---|---|---|---|
| Groupement Mousquetaires | Intermarché, Netto | 300 | Not disclosed in cited reporting | Not disclosed |
| Carrefour | Carrefour | 80 | ~6,000 | ~1.3% |
| Coopérative U | Hyper U, Super U, U Express, Utile | 80 | 2,000 | 4% |
| National total (Roland Lescure, French Parliament) | All affected chains | ~700 | 10,000 | 7% |
The gap between the disclosed per-chain figures and the national 700-store estimate suggests additional independent stores and smaller chains were also hit but have not issued their own public breakdowns. That gap is likely to narrow as the investigation progresses and as more retailers face pressure to disclose their exposure.
Why “still underway” changes the recovery math
Most cyberattack recovery stories follow a familiar arc: breach, containment, remediation, and a return to normal operations on a known timeline. France’s cybersecurity authority disrupted that arc by telling stores, in effect, that containment had not been confirmed. “The attacks were likely still underway,” the authority said, according to the Associated Press, even as Intermarché and other chains worked to restock shelves midweek.
That assessment forced a specific operational response. The authority’s guidance to affected stores was threefold: reconnect refrigeration systems to the internet only through a secure VPN connection or a protected network, install firmware updates before bringing equipment back online, and change every password associated with the refrigeration control systems. The Associated Press reported the guidance directly, noting it urged stores to reconnect refrigerators to the internet only through a secure VPN connection or protected network, install firmware updates, and change passwords.
Intermarché, for its part, went a step further and advised its own affected stores not to reconnect refrigeration systems to the network at all while restocking efforts continued, effectively running cold-storage operations in a degraded, offline state rather than risk a second compromise. That is a meaningful operational cost: modern commercial refrigeration increasingly relies on networked monitoring to catch temperature excursions before they become write-offs, and running blind during a restocking push raises the odds of a second round of spoilage.
The criminal investigation and the unresolved attribution question
The Paris prosecutor’s office opened an investigation through its cybercrime unit, a step that formally elevates the incident from a corporate IT emergency to a criminal matter under French law. The scope of that investigation reportedly includes both the spoiled-food losses tied to the refrigeration failures and reported fires linked to the incident, though neither the cause of the fires nor their scale has been independently detailed in the reporting reviewed for this story.
What remains conspicuously absent from the week’s reporting is any claim of responsibility. No group or individual had claimed the attack as of this writing, which is itself notable: ransomware crews and hacktivist groups alike typically move quickly to claim high-profile disruptions, either to extract payment or to make a political point. The silence leaves investigators, and the retailers footing the cleanup bill, without a clear adversary to negotiate with or defend against going forward.
How this compares to other industrial and OT-adjacent attacks
Refrigeration control systems sit in an awkward spot in enterprise security: they are operational technology, not traditional IT, but increasingly they are bolted onto the same internet-facing networks as point-of-sale systems and inventory management software. That hybrid exposure is exactly what makes this incident instructive for security teams well outside the grocery sector.
The pattern echoes, in structure if not in scale, previous OT-adjacent incidents where attackers targeted industrial control systems that were never designed with internet exposure in mind, then relied on the physical consequences, spoiled food, halted production, unsafe temperatures, to create pressure that a pure data breach would not. Security researchers have long warned that building management and refrigeration systems, like the kind implicated in this incident, often run years-old firmware and default credentials because they are treated as facilities equipment rather than IT assets requiring patch cycles.
That is also why the French cybersecurity authority’s remediation advice reads less like a one-time fix and more like a baseline hygiene checklist that should have been standard practice already: network segmentation through VPN access, current firmware, and unique passwords. The fact that these had to be issued as emergency guidance, rather than confirmed as already in place, says something about how exposed the sector was going into October 12.
Competitive comparison: three retailers, three responses
The three retail groups that have gone public with store counts, Groupement Mousquetaires, Carrefour, and Coopérative U, also diverged in how they handled the days immediately after the attack, offering a useful side-by-side of incident response philosophy under pressure.
Intermarché, under the Mousquetaires umbrella, took the most conservative path, advising affected stores not to reconnect refrigeration systems to the network at all while restocking continued. That is the slowest option operationally, since it means running cold storage without networked monitoring, but it is also the option least likely to expose a store to a second compromise while the French cybersecurity authority’s own “still underway” warning stood. Coopérative U, by contrast, leaned on public reassurance through chief executive Dominique Schelcher while mobilizing refrigeration specialists to restore systems, a response that prioritized visible recovery speed. Carrefour, with the smallest disclosed share of its network affected at roughly 1.3%, has said comparatively little publicly about its remediation steps beyond confirming the 80-store figure.
None of the three approaches has been shown to be wrong, since the underlying vulnerability and its root cause remain under investigation. But the split illustrates a real tension facing any retailer hit by an OT-adjacent attack: speed of recovery versus certainty that the threat has actually been contained.
Why US and global grocers should be watching closely
Nothing in the reporting reviewed for this story indicates the attack reached outside France, and no US or other international grocery chain has been named as affected. Still, the structural exposure that enabled the incident, networked refrigeration and building-management systems running outdated firmware on shared infrastructure, is not unique to French retailers. Large grocery chains in the United States, the United Kingdom, and elsewhere in Europe rely on similar remote-monitoring refrigeration platforms to track temperature compliance across thousands of locations.
That overlap is why the French cybersecurity authority’s three-part remediation guidance, VPN-only access, current firmware, unique passwords, reads as a reasonable baseline for any retailer running networked cold-chain equipment, not just the chains directly affected this week. US grocers in particular have faced their own run of retail-sector breaches in 2026, though none reported so far have involved refrigeration control systems specifically. A French incident that ties a government cybersecurity authority’s name to refrigeration hardening guidance is a useful prompt for any food retailer to check whether its own facilities equipment would pass the same three checks.
Timeline of disclosed events
| Date | Event | Source |
|---|---|---|
| Mon., Oct. 12, 2026 (early hours) | Attackers remotely seize control of refrigeration systems at supermarkets and independent stores across France | Multiple outlets |
| Oct. 12-13, 2026 | Carrefour, Coopérative U, and Groupement Mousquetaires disclose per-chain store counts; some units reportedly reach 50°C | BBC, PBS NewsHour |
| Oct. 13, 2026 | Finance Minister Roland Lescure tells Parliament about 700 of 10,000 supermarkets were affected; says no risk to food supply | Insurance Journal, Associated Press |
| Week of Oct. 12-16, 2026 | Paris prosecutor’s office opens cybercrime investigation covering spoiled-food losses and reported fires | Reporting cited in Insurance Journal coverage |
| Oct. 16, 2026 | French cybersecurity authority warns attacks are “likely still underway” as stores attempt to restock; issues VPN, firmware, and password guidance | Insurance Journal, Associated Press |
Market and industry impact
The immediate financial impact is concentrated in spoiled inventory rather than ransom payments or stock-price shocks, at least based on what has been disclosed so far. France’s grocery sector operates on thin margins and tightly managed cold-chain logistics, so even a localized refrigeration failure across hundreds of stores represents a real hit to weekly inventory costs, insurance claims, and, potentially, customer trust in food safety at affected locations.
Insurers are watching the incident closely for a reason beyond France’s borders. Business interruption and cyber-physical damage claims tied to OT-adjacent attacks have historically been harder to price than traditional data-breach claims, because the loss driver is physical spoilage and equipment downtime rather than data exposure or regulatory fines. A multi-retailer, multi-week incident like this one, with losses still being tallied and an investigation still open, gives underwriters a rare, concrete data point for modeling similar exposure across other food retail and cold-chain logistics operators, not just in France but in markets with comparable refrigeration infrastructure.
For retailers themselves, the operational lesson is less about any single vendor or software flaw and more about the gap between IT security budgets and the facilities equipment that increasingly shares their network. Refrigeration, HVAC, and building management systems rarely get the same scrutiny as point-of-sale terminals, despite being just as capable of taking a store offline, or in this case, spoiling an entire week of frozen stock.
Historical context: food supply chains as a security target
Attacks on food and agriculture infrastructure are not new, but they have typically targeted processing and distribution, meatpacking plants, grain logistics, dairy cooperatives, rather than retail-level refrigeration at the store level. What sets this incident apart is the sheer breadth of simultaneous impact: hundreds of stores across competing retail groups, all hit through what appears to be a shared class of refrigeration control vulnerability, on the same night.
That breadth is what pushed Roland Lescure to frame the attack in terms of food security rather than just IT security when addressing Parliament. It also explains why the Paris prosecutor’s cybercrime unit opened an investigation so quickly rather than leaving the matter to individual retailers and their insurers. A scattered, single-store refrigeration failure is a maintenance issue. Hundreds of simultaneous failures across multiple national retail chains, with a government warning that the threat persists, is a different category of event entirely.
What retailers and IT teams should take away from this
For technology and security teams outside France watching this unfold, the actionable lessons are fairly concrete, even without knowing who carried out the attack or exactly how they got in.
- Audit which facilities and OT systems, refrigeration, HVAC, building access control, share network paths with core IT infrastructure, and segment them where they do not need shared access.
- Treat refrigeration and building-management firmware on the same patch cadence as servers and endpoints, not as a once-a-year facilities task.
- Require VPN or equivalent protected-network access for any remote management of OT equipment, rather than direct internet exposure.
- Rotate default and shared credentials on facilities equipment, which is frequently deployed with vendor-set passwords that are never changed after installation.
- Build an incident response plan that accounts for physical consequences, spoilage, unsafe temperatures, production stoppage, not just data loss, since the remediation steps and business impact differ substantially.
Predictions: where this story goes next
Based on the pattern of disclosure so far, a few outcomes look likely over the coming weeks.
- More retailers will disclose their own store counts. The gap between the 700-store national figure and the roughly 460 stores accounted for across Mousquetaires, Carrefour, and Coopérative U suggests other chains and independent grocers have not yet gone public with their numbers.
- Attribution will likely take weeks, not days. With no group having claimed responsibility and the Paris prosecutor’s cybercrime unit only recently opening its investigation, a confirmed actor or motive is unlikely to surface quickly.
- Insurance claims tied to spoiled inventory and business interruption will become the clearest public measure of financial damage, likely surfacing before any official national loss total is confirmed by the French government.
- Expect regulatory scrutiny of OT security in food retail to increase, both in France and among regulators in other EU states watching the incident, given Lescure’s explicit framing of the attack as a food-security issue rather than a routine IT breach.
- Vendors supplying refrigeration control systems to French retailers will face pressure to publish security advisories, patch timelines, and firmware update guidance, mirroring the scrutiny similar industrial control vendors have faced after past OT-adjacent incidents.
None of these predictions are confirmed outcomes. They are reasonable extrapolations from how the investigation, disclosures, and remediation guidance have unfolded through October 18. Readers tracking the story should watch for updates from the Paris prosecutor’s office and any further retailer disclosures as the clearest signals of where this heads next.
Frequently asked questions
Is the French supermarket cyberattack over?
Not confirmed. France’s national cybersecurity authority said as of October 16 that the attacks were likely still underway, even as stores worked to restock shelves and restore refrigeration.
Which supermarket chains were affected?
Groupement Mousquetaires (Intermarché and Netto banners, 300 stores), Carrefour (80 stores), and Coopérative U (80 stores, under the Hyper U, Super U, U Express, and Utile banners) have each disclosed being affected. French Finance Minister Roland Lescure put the national total at roughly 700 of France’s 10,000 supermarkets.
How hot did the refrigeration units get?
Some units reportedly reached as high as 50°C (122°F). Intermarché said affected units stayed at that temperature for about six hours overnight before the issue was caught.
Is France’s food supply at risk?
Finance Minister Roland Lescure told Parliament there was no risk to France’s broader food supply, though he described the attack as touching “the heart of our food security.”
What should affected stores do before reconnecting refrigeration systems?
France’s cybersecurity authority advised reconnecting only through a secure VPN or protected network, installing firmware updates first, and changing all passwords tied to the refrigeration control systems. Intermarché went further, advising some stores not to reconnect to the network at all while restocking continued.
Who is responsible for the attack?
Unknown. No individual or group had claimed responsibility as of this writing. The Paris prosecutor’s office has opened an investigation through its cybercrime unit.
How much financial damage did the attack cause?
Unconfirmed. Estimates reported so far range from several million euros to potentially tens of millions, but no official national total has been confirmed.
Were fires connected to the attack?
The Paris prosecutor’s cybercrime investigation reportedly covers reported fires linked to the incident, alongside the spoiled-food losses, though further details on the fires have not been independently confirmed in the reporting reviewed for this article.