Imagine walking into your local supermarket to find the frozen-food aisle warm and the shelves being emptied into bins. That is exactly what happened across France this weekend, after hackers broke into the digital controls of supermarket refrigeration systems and forced them into a relentless defrost cycle at 50 degrees Celsius.
What Happened
The attack began hitting stores on October 11, 2026, and was confirmed the next day by Dominique Schelcher, chief executive of Coopérative U, which runs the Hyper U, Super U, U Express and Utile brands. In a public statement, he called the attack “unprecedented” and “unacceptable,” noting that refrigeration is essential to preserving fresh products and feeding the French public.
Some 150 to 200 Intermarché stores and nearly 100 Coopérative U outlets were affected, according to reports confirmed to AFP. France’s largest chain, E. Leclerc, was also reported hit, with hackers said to have remotely triggered forced defrosting across numerous stores. Paris prosecutors have confirmed an investigation is underway.
How the Attack Worked
The intruders did not go after payment systems or customer data. Instead they targeted the operational technology — refrigeration-control systems reportedly made by Danfoss — that manage cooling, temperature settings and defrost cycles. A defrost cycle is normally a brief, controlled process that prevents ice build-up. The attackers manipulated it so equipment heated far longer than intended, breaking the cold chain completely.
Once the cold chain breaks, there is no salvaging the stock: affected stores had to throw away all fresh and frozen products. In the town of Haguenau, Alsace, one Intermarché reportedly lost around €50,000 of frozen stock, while a nearby Super U discarded fresh and frozen goods worth an estimated €220,000. Early totals point to roughly €300,000 in losses — and if the full scope is confirmed, the damage could run into the millions. Reporting by Infosecurity Magazine and HackRead has been tracking the incident as it develops.
Why It Matters Beyond France
This is a textbook case of cyber-physical risk: a software intrusion becoming a physical supply-chain failure. As AI and automation race ahead across industries, ever more industrial equipment is going online — often without the security hardening that IT systems take for granted. Electronic shelf labels and delivery networks were reportedly disrupted too, showing how one weak link cascades.
For businesses, the lesson is uncomfortable but clear: if a system can be reached over the internet, someone will eventually reach it. Segmenting operational technology from corporate networks, patching control-system software, and keeping manual overrides for critical equipment are no longer optional extras.
This is a developing story. Details on the attackers’ identity and entry method have not yet been confirmed.