Les Mousquetaires

Summary

Intermarché supermarket in France had its refrigeration systems breached on Oct. 12, 2026, resulting in tens of millions of dollars in damages.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Connected building-control systems had been identified as a significant cyber risk before the refrigeration campaign. Many systems had been installed decades earlier and still relied on communications protocols that were not designed with security in mind. Networked temperature controls used in refrigeration had been specifically associated with the risk of unauthorized set-point changes. That risk materialized on Oct. 12, 2026, when hackers compromised online control systems belonging to European grocery-store refrigeration installations.

The attackers manipulated refrigeration controls to defrost grocery-store refrigerators across Europe. The action represented the set-point tampering that security specialists had previously warned could be used against connected temperature-control systems. Linked reporting identified Danfoss refrigeration controllers as the equipment involved. The disruption affected hundreds of supermarkets and caused widespread losses of refrigerated food products. Intermarché, the supermarket banner operated by Les Mousquetaires, was among the grocery companies whose refrigeration systems were breached. The resulting food losses were estimated at tens of millions of dollars.

Initial reporting on the campaign was published Oct. 13, and further coverage on Oct. 16 focused on the continued exposure of refrigerator devices following the attack in France. Thousands of devices remained exposed, and the investigation indicated that the incident had implications for industrial systems beyond the supermarkets initially identified as victims. The published account did not identify the attackers, describe how the initial access was obtained, or report data theft alongside the operational disruption. It also did not specify the number of Les Mousquetaires or Intermarché stores affected.

The operational consequences included the widespread loss of refrigerated inventory and tens of millions of dollars in damages. Refrigeration equipment in affected stores was subjected to unauthorized temperature changes that initiated defrosting and spoiled or made unusable the stored products. The article did not report a completed restoration of every affected system or provide details about how individual stores recovered their inventory. It also did not describe the detection process, containment measures, patching activity, or other technical steps used to secure the compromised controllers.

By Oct. 20, the published assessment said the incident had demonstrated how connected building-automation systems could be used to disrupt physical operations rather than merely affect conventional corporate data. It placed the event in the context of longstanding vulnerabilities in legacy building controls and their communications protocols. The confirmed endpoint of the campaign was therefore the defrosting of refrigeration systems at hundreds of European supermarkets, the destruction of refrigerated products, tens of millions of dollars in losses, and the continued exposure of thousands of devices.

Sources

Sources available to members: 4 sources.