A major cyberattack targeting refrigeration systems at hundreds of supermarkets in France caused temperatures to soar overnight, triggering fires and forcing retailers to discard large quantities of food. Investigators are examining whether the incident exploited weaknesses in remotely accessible equipment used to control commercial refrigerators and freezers.

The Paris prosecutor’s office described the incident as a “large-scale” attack “affecting connected refrigerators in several major food retailers across France,” resulting in fires and spoiled merchandise.

Prime Minister Sebastien Lecornu directed France’s National Cybersecurity Agency, known as ANSSI, to investigate, according to a source in his office.

French authorities were also working with their European counterparts because the attack may have crossed national borders. Officials were examining whether additional businesses in France could be vulnerable, the source said.

Felix Aime, a senior cyber threat intelligence analyst at Sekoia Threat Detection and Research, said the incident had also affected Spain, Portugal, Poland, Germany and Belgium.

Carrefour reported that 80 of its supermarkets were impacted. Monoprix, which operates approximately 490 locations in France, said the attack affected about 5% of its stores.

Les Mousquetaires, the company behind the Intermarche supermarket chain, said refrigeration units at approximately 150 stores had been heated to 50 C for six hours overnight. A company spokesperson said all affected food was thrown away as a precaution against potential health hazards.

In central Paris, resident Geert de Clercq saw Intermarche employees disposing of cartloads of thawed frozen products in a large waste container. Melted ice cream spilled from damaged tubs onto the street.

Cooperative U CEO Dominique Schelcher said the incident affected 80 of the group’s roughly 2,000 stores.

“It affected a minority of our stores,” he told RTL radio.

Schelcher said the company had not yet calculated its total losses. He estimated that damage at a smaller supermarket could reach tens of thousands of euros, while losses at a larger hypermarket could climb to €200,000 ($223,480).

E.Leclerc and Auchan, two other major French supermarket operators, did not immediately respond to requests for comment.

Although the overall financial damage across the retail industry remained unclear, Intermarche CEO Thierry Cotillard told BFM TV that the “unprecedented” attack would result in losses amounting to “tens of millions of euros nationwide in a single day.”

Christel Delberghe, director general of European retail association Eurocommerce, said, “This incident underlines the importance of resilience across the entire supply chain.”

Supermarket refrigeration systems are commonly managed through centralized control panels that regulate refrigerators and freezers throughout a store. These systems can be connected to the internet, allowing maintenance providers to monitor and adjust equipment remotely.

Software Vulnerability Under Investigation

A source close to Lecornu said ANSSI had identified a vulnerability involving software provided by Danish engineering company Danfoss.

Danfoss confirmed that it was investigating the situation, saying it was “aware of incidents in France affecting a limited number of refrigeration management systems.”

The company said the affected equipment “were running outdated firmware,” adding that it had “long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions.”

On August 9, cybersecurity company Claroty published research through its Team82 security research division describing vulnerabilities in a Danfoss controller. The report said software patches released by Danfoss addressed flaws that could have enabled attackers to circumvent authentication protections and run code on compromised devices.

The French incident bears similarities to disruptions reported at roughly a dozen U.S. military commissaries in late August, when refrigeration problems caused food losses.

France’s retail trade association, Fédération du Commerce et de la Distribution, called on Danfoss to provide “full transparency” about the incident. The organization said retailers were working to safeguard consumers and restore normal operations as quickly as possible. It also reported that some affected supermarkets had already resumed normal activity.

Dutch Supermarket Group Reports Separate Cybersecurity Incident

Ahold Delhaize, the Dutch retail group that operates Albert Heijn, the Netherlands’ largest supermarket chain, and maintains substantial operations in the United States, said it was addressing a “security issue” affecting its network. The company temporarily disconnected several systems as a precaution.

A notification on Albert Heijn’s mobile app said grocery deliveries were unavailable because of a “cybersecurity incident.”

Online purchases account for approximately 10% of Albert Heijn’s sales. Its physical supermarkets remained open, while Dutch news agency ANP reported that competing retailers experienced a surge in delivery orders.

Ahold Delhaize said there was no basis at that point to conclude that its incident was connected to the attacks affecting French supermarkets.

The company ranks as the fourth-largest grocery retailer in the United States. Websites operated by its Stop & Shop, Giant, Hannaford and Food Lion chains displayed messages stating “site temporarily down.”

It remained unclear whether the disruption had affected any other parts of the company’s operations.