Cyberattack on supermarkets: 'The most likely scenario is an attack linked to a state'

Hundreds of supermarkets across Europe faced a coordinated cyberattack in late September and early October 2026, with hackers remotely taking control of refrigeration systems and raising temperatures inside freezers and coolers to dangerous levels. The attacks caused widespread food spoilage, financial losses, and safety concerns, prompting investigations and heightened awareness of critical infrastructure vulnerabilities. In France, the first known incidents occurred on October 11–12, targeting refrigeration systems managed by Danfoss, a Danish company. Temperatures in some units spiked to 50 degrees Celsius (122 degrees Fahrenheit), forcing stores to discard perishable goods due to health risks. A second wave of attacks followed on October 12–13, this time affecting systems operated by Italian firm Dixell. Retailers including Carrefour, Monoprix, and Intermarche reported significant disruptions, with some stores losing tens of thousands of euros in inventory. The attacks spread beyond France, with reports indicating that Spanish, Portuguese, Polish, German, and Belgian supermarkets also suffered similar issues. In one instance, employees at an Intermarche in central Paris were seen discarding large quantities of spoiled food onto the streets. The scale of the disruption led to calls for urgent action from industry leaders and cybersecurity experts. French prosecutors confirmed that a “large-scale” cyberattack was underway, affecting multiple major food retailers. Authorities have launched an investigation, with France coordinating efforts with European partners to assess the broader impact. Prime Minister Sebastien Lecornu directed the National Cybersecurity Agency (ANSSI) to lead the inquiry, emphasizing the need for cross-border collaboration given the potential involvement of other nations. Experts believe the attacks exploited known vulnerabilities in refrigeration system controls. A report by Claroty, a cybersecurity firm, had previously highlighted weaknesses in Danfoss systems, warning that hackers could manipulate temperature settings through exposed network connections. Despite warnings and available patches, many systems remained vulnerable, leaving them open to exploitation. The incident has sparked concern among cybersecurity professionals, who argue that the increasing reliance on interconnected technologies makes critical infrastructure more susceptible to such attacks. Pablo Morales, a researcher specializing in small business and public administration cybersecurity, noted that the failure to patch known flaws reflects a common oversight in maintaining secure operations. The attacks underscored the growing threat posed by both human-operated and AI-assisted hacking methods. With the rise of artificial intelligence, the ability to orchestrate large-scale cyberattacks has become more sophisticated, posing new challenges for global security frameworks. Industry representatives called for stronger measures to protect essential services and ensure resilience against future threats. As investigations continue, officials are working to identify the perpetrators behind the attacks. The Paris Prosecutor’s Office has assigned the case to the Anti-Cybercrime Office (OFAC), aiming to trace the origins of the breach and determine the extent of the damage. Meanwhile, cybersecurity agencies across Europe are reviewing protocols to prevent similar incidents from occurring in the future.