Cyber attack hits the cold of hundreds of supermarkets in France

Hundreds of French supermarkets were subjected on the night of Sunday 11 to Monday, October 12, 2026, to a cyber attack against their refrigeration facilities. Intermarket and Netto, Cooperative U, E.Leclerc and Monoprix are among the brands concerned. The information of franceinfo, BFMTV and AFP, taken in particular by 24 hours and RFI, converges on the same event: disturbed cold equipment from a distance, with food stocks that became unfit for sale. [S1][S3][S6][S7]

A still evolving balance sheet according to the signs

The Les Mousquetaires group tells BFMTV that 300 Intermarché and Netto stores were assigned. The AFP dispatch published in 24 hours mentions at least 300 outlets of these two brands, less than a hundred at Cooperative U, several E.Leclerc stores and about thirty from Monoprix. These figures are based on confirmations from the four distributors at the agency. [S1][S7]

Differences between publications, however, require that the balance sheet not be frozen. RFI and CNews refer to 150 to 200 Intermarket, while franceinfo reports a range of 200 to 300. BFMTV states that the count of Musketeers has been recorded since the first estimates. The perimeters also differ: some publications speak Intermarket alone, others include Netto. For Monoprix, franceinfo indicates 5% of the network, without allowing an exact comparison with the 30 stores cited by AFP. [S1][S3][S4][S6][S7]

The presence of Carrefour Market among victims remains less established in the articles consulted: it is reported from the specialized site I work in large distribution, without confirmation of the sign. In addition, 24 hours and the Geneva Tribune broadcast the same AFP text: their reconciliation does not therefore constitute two independent verifications. [S1][S2][S6]

Deicing would have been diverted

Technical information points to Danish manufacturer Danfoss' refrigeration control systems. According to BFMTV, pirates have diverted the de-icing function by imposing forced and continuous operation, with a 50°C set-up. Franceinfo also reports this setting. It is a programmed temperature: these elements do not show that all equipment or foodstuffs have actually reached 50 °C. [S3][S7]

Danfoss confirms to franceinfo incidents in France concerning a limited number of refrigeration management systems. The manufacturer claims that the majority of the devices concerned are obsolete, including AK-SM800 and AK-SC355, which have reached the end of their lives and have been deprived of software and security updates. This precision describes the equipment affected, without alone establishing the exact path followed by the attackers. [S3]

The company says it is working with its customers on risk reduction measures: updates where they exist, strengthening network protections and removing direct exposure to the Internet where appropriate. It also recommends replacing obsolete systems with still-supported solutions. [S3]

Products withdrawn, unconsolidated losses

Intermarket explains having to discard the fresh and frozen products concerned in order to respect the cold chain. Franceinfo describes in particular the emptying of refrigerated containers and the realization of findings. According to information collected by BFMTV, some stores later in the night could have saved some of their goods: the consequences are therefore not uniform. [S1][S3][S7]

National losses could amount to several million euros, according to sources cited by France Inter and BFMTV, but no consolidated financial balance sheet is presented. Intermarket also raises the issue of insurance, considering that this type of incident is not covered in stores. This position of the sign does not make it possible to conclude all the contracts of the distributors concerned. [S3][S6][S7]

A survey to clarify the extent and origin

The Paris Public Prosecutor ' s Office opened an investigation, led by its Anti-Cybercrime Section and entrusted to the Anti-Cybercrime Office. It must identify the victims and establish the link between the attack and the reported damage. RFI and CNews also mention fire departures reported to the prosecution; their connection to the attack must be examined by the investigators. [S1][S4][S6]

According to the Prime Minister's entourage quoted by franceinfo, Sébastien Lecornu asked the Anssi to take up the case. The agency reportedly identified a vulnerability in Danish software and contacted its publisher. However, the publications consulted do not allow for the identification of those responsible, their motives or a definitive assessment of the damage. The term "unpublished", used by Dominique Schelcher and Les Musquetaires, expresses their appreciation of the attack, not a conclusion of the investigation. [S1][S3][S4]