French Supermarkets Ransomware: Refrigeration Systems Targeted, Food Spoiled (October 2026)

Intermarché, Netto, Coopérative U, Carrefour, E.Leclerc, Monoprix: What Happened

Between October 11 and 12, 2026, a coordinated ransomware attack targeted the refrigeration-control systems of several major French supermarket chains, including Intermarché, Netto, Coopérative U, Carrefour, E.Leclerc, and Monoprix. The attackers specifically compromised Danfoss refrigeration-management systems deployed across hundreds of stores. As a result, defrost cycles were manipulated, causing widespread spoilage of refrigerated and frozen food, damage to refrigeration equipment, and in some cases, fires. The incident led to significant operational disruptions, with some stores or departments forced to close temporarily.

Attack Vector & Technical Detail

The attackers gained unauthorized access to Danfoss refrigeration-management systems, likely exploiting weaknesses in remote access protocols or insufficient network segmentation. While no specific CVEs or IOCs were provided in the incident report, the attack demonstrated tactics consistent with MITRE ATT&CK techniques TA0001 (Initial Access), TA0005 (Defense Evasion), and TA0040 (Impact). The adversaries bypassed existing controls to manipulate critical infrastructure, extending defrost cycles and causing system malfunctions. The Paris prosecutor’s office has opened an investigation, indicating the severity and complexity of the intrusion.

Confirmed Impact

The ransomware attack resulted in several million euros in financial losses due to spoiled food and damaged refrigeration equipment. Fires were reported in some locations, compounding the physical and operational impact. Temporary closures of affected stores or departments disrupted stock availability and supply chains across France. The incident has regulatory implications, as food safety and waste became immediate concerns, and law enforcement is actively investigating the breach.

What This Means for Your Organization

This incident underscores the risk of ransomware targeting operational technology (OT) and IoT systems, especially those controlling critical infrastructure like refrigeration. Organizations should review network segmentation policies, restrict remote access to OT devices, and ensure that all control systems are regularly updated and monitored for anomalous activity. Proactive defense and incident response planning are essential to mitigate the risk of cascading operational and financial impacts from similar attacks.

Detection & Response

• Immediate: Isolate affected refrigeration-control systems from the network and initiate incident response protocols.
• Hunt: Monitor for unauthorized access attempts or abnormal changes in control system configurations, especially targeting Danfoss management interfaces.
• Patch: N/A (no specific CVE identified in this incident).

Source: https://www.malwarebytes.com/blog/news/2026/10/hackers-heat-up-supermarket-fridges-spoiling-food-across-france