French Supermarket Hack: Some Freezer Defrost Cycles Extended to Eight Hours To Delay Alarms, Report Says

French supermarket hackers allegedly forced some freezers to stay in defrost mode for up to eight hours overnight on 11–12 October, a French media report has claimed, delaying alarms as temperatures surged and forcing shops to throw away food. The account, from Le Monde, emerged after cyberattacks disrupted cold storage at hundreds of outlets across the country.

Affected retailers disposed of fresh and frozen stock after temperatures rose beyond safe storage levels. French authorities opened an investigation on Monday into the attacks and reported fires. The precise way the intruders accessed the equipment has not been publicly established.

The disruption affected several major chains, including Intermarché, Netto, Coopérative U and Carrefour. Connected controllers used to monitor refrigeration equipment were targeted, raising questions about the security of systems that can be operated remotely.

For retailers, the immediate problem was more tangible, with food they could no longer sell.

How the French Supermarket Hack Delayed Alarms

Commercial refrigeration equipment periodically enters a defrost cycle to remove ice. Le Monde reported that attackers changed settings in some freezers and cold-storage rooms, increasing the duration from one hour to eight hours.

The newspaper said the manipulation postponed alarms, delaying intervention and worsening damage. The finding is attributed to its reporting, not to a published technical reconstruction by investigators.

In Gradignan, near Bordeaux, Intermarché owner Charles Dezon said a delivery driver found his storeroom flooded at about 4am. Dezon believed the attack had begun around 11pm.

He told Le Monde the cold room reached 50°C and triggered a sprinkler, while the store lost €21,000 worth of stock at purchase price.

Elsewhere, Intermarché said affected shops would need to discard products stored in compromised fresh and frozen units. Removing food was a precaution against breaks in the cold chain, rather than evidence that every item had been tested and found unsafe. Some shops also had to close temporarily while staff cleared stock and checked equipment.

Official Alert Identifies Four Refrigeration Controller Families

France's national cybersecurity agency, ANSSI, initially warned about Danfoss AK-SC and AK-SM controllers. In an updated advisory dated 13 October, it also identified Copeland xweb and Dixell xweb among the affected product families. The alert describes multiple compromises of remote refrigeration controllers.

ANSSI urged operators to remove affected equipment from direct internet access and inspect configuration settings, including defrost schedules. It recommended restoring remote access only through a secure VPN or protected network.

Restricting access to trusted IP addresses could serve as a temporary measure, the agency said, but not a permanent solution.

Danfoss said many affected units were older products that no longer received software or security updates, while others had outdated firmware. It said customers had long been advised to update supported systems or replace obsolete equipment.

Neither the manufacturer's statement nor ANSSI's advisory identifies the specific intrusion method used in every compromised store.

Supermarkets Assess Losses as Store Estimates Change

The number of affected outlets has varied across reports. Les Mousquetaires, the group behind Intermarché and Netto, gave an estimate of about 180 stores, while other reports put the number of targeted outlets at around 300.

Coopérative U chief executive Dominique Schelcher provided an updated count on Tuesday, saying 80 of its roughly 2,000 shops were affected. Carrefour reported 80 locations, Monoprix around 30 and E.Leclerc disruption at several stores.

At least 350 supermarkets overall had been caught up in the attack. Losses are still being assessed. Two supermarkets in Alsace reportedly recorded combined losses of €270,000, while Les Mousquetaires warned of damage running into millions of euros.

Thierry Cotillard, head of the group, gave a higher estimate of tens of millions nationwide. Neither estimate is a final audited total.

Paris prosecutors opened an investigation into the large-scale intrusion, including reported fires at some premises. Investigators are examining the connection between the hacking, food losses and those incidents. The cause of individual fires has not been conclusively established.

ANSSI is coordinating with European counterparts as it assesses potential further exposure. At the time of publication, no group had come forward to claim responsibility, and the identities of the attackers remain unknown.

Retailers meanwhile face the slower work of repairing or isolating controllers, replacing discarded stock and reopening affected refrigeration areas.