Cyberattack forces French supermarkets to discard spoiled food, raising food security concerns

On Sunday night, something went wrong in the refrigeration systems of hundreds of French supermarkets. The systems did not fail on their own. Hackers had remotely forced them to defrost, turning cold storage into warm rooms, spoiling everything inside. By Monday, major retail chains were confirming what had happened: E. Leclerc, Intermarche, and Cooperative U had all been hit. The attack was precise, coordinated, and devastating in its simplicity.

The scale became clear as statements arrived. At least 300 Intermarche and Netto stores had been affected. More than 100 Cooperative U locations were compromised. Several E. Leclerc stores went down as well. Reports suggested the damage extended beyond these three chains—Carrefour Market and Monoprix may have been targeted too, though neither had publicly confirmed it by the time the story broke. Across all these stores, workers faced the same grim task: throwing away fresh and frozen products that could no longer be sold or eaten. The food was gone. The waste was real.

Dominique Schelcher, chief executive of Cooperative U, called the attack "unprecedented." He was not exaggerating. In a statement posted to social media, he wrote that targeting "equipment essential to the preservation of fresh products and to the food supply of the French people" crossed a line that had not been crossed before. This was not a data breach or a theft of customer information. This was an assault on the infrastructure that keeps a nation fed.

The vulnerability that made the attack possible was not new. Danfoss, a Danish manufacturer, had supplied refrigeration control systems to these supermarkets—models like the AK-SM800 and AK-SC355. The problem was that many of these units were old. They no longer received software updates or security patches. Some were running outdated firmware that had no protection against modern threats. Danfoss had been recommending for some time that supermarkets replace these systems, but many had not. The company did not say how many units had been compromised, but the number was large enough to affect hundreds of stores across the country.

French authorities moved quickly. Paris prosecutors confirmed the cyberattack and noted that fires had also been sparked in some locations—whether as a secondary effect or a separate component of the attack remained unclear. France's cyber security agency had already identified the vulnerability in the Danfoss software and contacted the vendor. According to a source close to Prime Minister Sebastien Lecornu, the agency was coordinating with European counterparts because other countries might be affected too. A formal investigation was launched.

The attack landed at a moment when food security was already a concern across Europe. Christophe Hansen, the European Union's food and agriculture commissioner, condemned the incident on social media and warned that the "exploitation of food" was now a demonstrated reality. "Food security requires more attention at all levels," he said. The message was clear: critical infrastructure that had seemed immune to cyberattacks was vulnerable. The systems that keep supermarket shelves stocked and refrigerated could be turned into weapons. What happened in France on Sunday night could happen anywhere, to anyone, at any time.