Cyber Insights: Cyber Attack on French Supermarkets Reportedly Sends Refrigeration Temperatures to 50°C
6 Min Read
22nd October 2026
Overview
French supermarket chains are investigating a suspected cyber attack that reportedly caused refrigeration systems to malfunction, with temperature settings reaching as high as 50°C.
The incident occurred overnight between 11 and 12 October 2026 and reportedly affected stores associated with Intermarché, E.Leclerc and Système U. Approximately 300 Intermarché/Netto stores, 90 Coopérative U stores, 80 Carrefour stores, around 30 Monoprix stores and several E.Leclerc locations are believed to have been impacted, although the full scale of the disruption remains unclear.
Early reports suggest attackers manipulated refrigeration-management systems associated with Danish technology manufacturer Danfoss, potentially forcing equipment into continuous defrost cycles and preventing it from maintaining safe food-storage temperatures.
The consequences have reportedly included spoiled stock, food disposal and significant operational disruption, with some locations potentially facing losses of hundreds of thousands of euros.
The incident highlights a growing cybersecurity concern: attacks against operational technology (OT) can cause substantial physical and financial damage without conventional malware or data theft.
How Were the Refrigeration Systems Targeted?
Unlike traditional cyber attacks that focus on stealing information or encrypting files, this incident appears to have targeted the systems responsible for controlling physical refrigeration equipment.
According to preliminary reporting, attackers gained the ability to manipulate refrigeration-management settings, potentially changing temperature setpoints and activating defrost functionality for prolonged periods.
Defrost cycles are a normal part of refrigeration operations, designed to prevent ice accumulation. However, when triggered excessively or continuously, they can prevent equipment from maintaining the temperatures needed to preserve perishable goods.
Reports suggest settings were changed to temperatures as high as 50°C, although it has not yet been established whether this represents configured setpoints or actual temperatures measured inside the affected equipment.
The precise method used to access the systems remains unknown. Possible routes include compromised remote-access credentials, exposed management interfaces or vulnerabilities in refrigeration-control software, but none has been confirmed.
Why This Matters
The incident demonstrates how legitimate industrial control functions can potentially be turned against the organisations that depend on them.
For supermarkets and food distributors, refrigeration is essential to everyday operations. Even a relatively short disruption can render large quantities of food unsafe for sale, interrupt trading and create substantial financial losses.
The wider concern is that many commercial refrigeration systems are remotely managed, often with access provided to external maintenance contractors and equipment suppliers.
If those access pathways are compromised, attackers could potentially manipulate equipment across multiple locations without physically accessing individual stores.
This also creates a challenge for conventional security monitoring. An unauthorised temperature adjustment or defrost command may not resemble a traditional cyber attack, particularly if it is carried out through legitimate management software.
Detecting this behaviour requires visibility into both digital activity and the physical processes being controlled.
Are Known Vulnerabilities Involved?
The affected refrigeration infrastructure has reportedly been associated with Danfoss, although the specific controller models and software versions involved have not been confirmed.
Previous CISA advisories have highlighted vulnerabilities affecting certain Danfoss AK-SM 8xxA refrigeration controllers, including authentication weaknesses and issues that could allow unauthorised manipulation of system settings.
Separate security research has also identified vulnerabilities in Copeland XWEB Pro refrigeration controllers, demonstrating how weaknesses in remotely managed cooling systems could affect physical operations.
However, there is currently no confirmed evidence that any previously disclosed vulnerability was exploited in the French supermarket incident.
Organisations should therefore review relevant manufacturer security advisories without assuming a particular vulnerability or exploitation technique was responsible.
Detection & Monitoring Recommendations
Security teams responsible for retail, food distribution or cold-storage environments should review whether refrigeration-control systems are included within their existing monitoring arrangements.
Particular attention should be given to:
Unexpected changes to temperature setpoints or operating modes
Unusual administrator or third-party maintenance logins
Remote access from unfamiliar locations or IP addresses
Changes to alarm thresholds or monitoring configurations
Similar configuration changes appearing across multiple sites
Temperature readings deviating significantly from expected ranges
These indicators should be assessed alongside maintenance records and operational telemetry, as equipment faults or legitimate servicing can produce similar symptoms.
Where possible, SOC teams should correlate controller activity with identity, network and remote-access logs to establish whether unusual physical behaviour followed suspicious digital access.
Recommended Actions
Organisations operating remotely managed refrigeration equipment should establish an accurate inventory of their controllers, management platforms and software versions.
Internet-facing management interfaces should be reviewed, unnecessary exposure removed and remote administrative access restricted to authorised personnel using strong authentication.
Third-party access also deserves particular attention. Maintenance contractors should have clearly defined permissions, with their activity logged and monitored wherever technically possible.
Network segmentation should separate refrigeration OT from unrelated corporate systems, while monitoring should identify unauthorised changes to critical operating parameters.
Importantly, any suspected compromise must be managed alongside operational engineers and refrigeration specialists. Disconnecting or shutting down equipment without considering the physical consequences could worsen the disruption, particularly where food safety is already at risk.
Analyst Assessment
The reported incident represents a concerning example of the potential consequences of cyber attacks against operational technology.
The apparent manipulation of refrigeration settings demonstrates how attackers could use legitimate equipment functionality to disrupt physical processes and cause substantial financial losses.
However, several important details remain unconfirmed, including the initial access method, affected controller models, exploitation technique and identity of the attackers.
For organisations operating similar infrastructure, the immediate priority should be to review remote-access security, assess exposure of refrigeration-management systems and improve monitoring of critical configuration changes.
More broadly, the incident reinforces the importance of treating operational technology as a core part of an organisation’s security posture rather than an isolated facilities-management responsibility.
How NormCyber MDR Helps Identify Threats to Operational Systems
Attacks against operational technology can be difficult to identify because malicious activity may involve legitimate administrative tools, trusted remote connections or ordinary configuration changes.
NormCyber’s Managed Detection and Response (MDR) service provides continuous monitoring across supported endpoints, identities and network environments, helping organisations identify suspicious activity that could precede or accompany an attack on connected operational systems.
Our SOC analysts investigate unusual remote-access activity, compromised credentials, unexpected administrative behaviour and suspicious network connections, correlating these signals to identify potential threats before they develop into wider operational disruption.
Working alongside an organisation’s IT and operational teams, NormCyber MDR helps strengthen visibility into the digital pathways attackers may exploit, supporting faster investigation and more informed response when critical business systems are at risk.
