France investigates cyberattack on supermarket refrigeration

French supermarkets face refrigeration cyberattack

A cyberattack on supermarket refrigeration and freezer systems in France has prompted a public-prosecutor investigation after stores reported spoiled food, damaged equipment and major disruption to their operations.

According to reports from affected retailers and staff, digital thermostats controlling cold aisles began behaving abnormally shortly before midnight on a Sunday. The systems were reportedly overridden remotely, sending temperatures in refrigeration units far above their normal settings.

The disruption affected equipment intended to keep goods frozen or chilled. Temperatures that had been as low as minus 27C were reported to have risen above 50C. One supermarket in Normandy said some of its freezers reached 80C. Staff arriving for early shifts described hot air coming from units that should have been preserving food.

The immediate consequence was the loss of stock. Food first defrosted and then warmed further during the four-to-six-hour period described in the report. At an Intermarché store in Issy-les-Moulineaux, south-west of Paris, employees said freezers had been pushed to 62C and that all food inside them had to be discarded.

Hundreds of stores reportedly affected

What initially appeared to some managers to be isolated equipment failures quickly appeared to be a wider incident. Up to 700 stores were reported to have been targeted, including outlets connected to Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix, as well as smaller independent shops.

Coopérative U president Dominique Schelcher said 80 of the group’s 2,000 supermarkets had been affected. He characterized the incident as unprecedented and extremely serious. The scale matters because modern food retailing depends on networked controls across large numbers of cabinets, freezers and chillers. When those controls fail or are manipulated, a local technology problem can rapidly become a problem of food waste, store operations and safety procedures.

At some stores, the sharp temperature rise reportedly caused fires. Sprinklers then activated, adding water damage to the losses from spoiled products. In Paris, staff removed tons of goods and worked late to reorder and restock shelves. Workers at the affected Intermarché said they were able to bring the store close to normal operations on the same day, but only after clearing the freezer inventory.

A physical consequence of a digital intrusion

The incident illustrates how cyberattacks can affect physical systems rather than only data, communications or online services. Refrigeration controls are operational technology: software-connected systems that direct equipment in the real world. In a supermarket setting, their proper operation underpins the cold chain used to hold frozen and chilled goods at appropriate temperatures.

That connection between digital controls and physical equipment is why the reported attack produced such visible consequences. Instead of a website outage or a stolen database, stores faced overheated cabinets, perished products, disrupted replenishment work and, in some cases, fire and water damage.

The report does not establish who was responsible or what motive lay behind the incident. Possibilities raised in coverage range from people seeking to demonstrate their technical abilities to more serious sabotage, but no attribution is provided. The Paris public prosecutor’s office opened an investigation immediately after the attack came to light.

Investigation begins as retailers restore operations

The central questions for investigators will include how access was obtained, whether a shared technology provider or connected control pathway was involved, and whether affected stores had a common exposure. The supplied reporting does not provide those answers, nor does it identify a confirmed attacker.

For retailers, the near-term task is more immediate: remove unsafe stock, restore equipment, assess damage and replenish stores. The event also leaves a broader operational lesson. Retail systems increasingly rely on connected hardware to improve monitoring and efficiency, but those connections can turn a cybersecurity incident into a direct interruption of essential equipment.

In this case, the impact was measured not just in disrupted technology but in spoiled food and the labor required to recover store operations. As the investigation proceeds, the attack will be closely watched as an example of the risks facing digitally managed infrastructure in everyday commerce.

This article is based on reporting by The Guardian. Read the original article.