E.Leclerc

Summary

Hackers remotely raised the temperature of connected refrigeration units in hundreds of French supermarket stores to about 50°C, leading to spoiled food and reported fires; Intermarché said roughly 150 of its outlets were affected and Coopérative U confirmed similar impacts, while E.Leclerc was also reported to have experienced forced defrosting in numerous stores. The French prosecutor’s office and ANSSI investigated the attack, which was linked to a vulnerability in outdated firmware of Danfoss‑supplied systems, and Ahold Delhaize reported related security issues in its Dutch and Belgian operations.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On 12 October 2026, hackers remotely raised the temperature of connected refrigeration units in hundreds of French supermarkets to as high as 50 °C overnight, according to the Paris prosecutor’s office which described the event as a large‑scale attack on several major food retailers. Reports from BFM TV indicated that France’s largest chain, E.Leclerc, was among those affected, with hackers managing to trigger forced defrosting of the refrigeration systems in numerous E.Leclerc stores. Les Mousquetaires, owner of Intermarché, said about 150 of its outlets experienced the temperature increase for roughly six hours and discarded all perishable food to avoid health risks. Dominique Schelcher, chief executive of Coopérative U, confirmed that his stores were also hit and characterised the targeting of essential preservation equipment as unprecedented and of extreme gravity. The prime minister, Sébastien Lecornu, directed France’s national cybersecurity agency ANSSI to investigate the incident while the government coordinated with European counterparts to determine whether other countries were affected.

The temperature spikes caused food losses and were linked to reports of fires in some locations, prompting affected retailers to remove potentially unsafe products from shelves. E.Leclerc did not issue a public comment on the incident despite requests for information. ANSSI’s investigation traced the compromise to a vulnerability in refrigeration management software supplied by the Danish company Danfoss, which noted that the affected units were running outdated firmware and reiterated its long‑standing advice to customers to keep firmware current and to migrate legacy systems to supported versions. In the Netherlands, Ahold Delhaize reported a separate security issue that led it to take several systems offline; its Albert Heijn chain kept stores open but experienced disruption to its online app, delivery service and electronic price tags, which sometimes displayed incorrect information. Authorities stated that it was not yet clear whether the Dutch problems were connected to the French supermarket attack.

The episode took place amid heightened concern over the potential for cyber‑attacks to disrupt critical infrastructure across Europe, a context highlighted by French president Emmanuel Macron’s earlier order to strengthen defenses against Russian hybrid attacks. No further details about the attackers’ identity, motive, or the exact duration of the temperature rise beyond the six‑hour window cited for Intermarché were disclosed in the available sources. The narrative concludes with the confirmed facts of the attack’s scope, its immediate impacts on food safety and store operations, and the investigative steps undertaken by French and European authorities.

Sources

Sources available to members: 3 sources.