A major cyberattack targeting commercial refrigeration systems across France has left more than 150 supermarkets facing millions of euros in damages after hackers remotely altered fridge temperatures overnight.

The attack compromised cold-chain control software across nationwide locations of Intermarché, E.Leclerc, and Coopérative U (Super U).

Rather than shutting systems off, the attackers remotely reprogrammed cooling regulators to force a continuous defrost cycle, driving internal temperatures up to 50C.

Store workers arriving on Monday morning discovered compromised units left vast quantities of fresh produce, meat, dairy, and frozen goods completely spoiled.

Dominique Schelcher, head of Coopérative U, confirmed his retail network was among those hit, stating that technical teams are now working alongside specialists to restore normal operations.

Individual sites have reported severe inventory losses. An Intermarché and an E.Leclerc store in Haguenau, eastern France, estimated combined stock damages at €270,000 (£225,000), according to regional news outlet Sud Ouest.

Security experts have indicated the hackers exploited vulnerabilities in remote management software manufactured by cooling systems firm Danfoss.

Previous cyberattacks have targeted key infrastructure in France. In August, hackers breached the country’s internal tax agency systems, compromising income and property records for 678,000 taxpayers and businesses.

In early 2024, cybercriminals compromised third-party payment processors Viamedis and Almerys, exposing the personal data of 33 million healthcare policyholders across France, forcing pharmacies nationwide to temporarily revert to manual processing.

Together, the incidents highlight the growing vulnerability of French critical supply chains to third-party software breaches.

French law enforcement and national cybersecurity agency ANSSI have now opened an investigation to identify the origin of the supermarket attack.

Dutch supermarket operator Ahold Delhaize, which operates the ⁠Netherlands’ largest supermarket chain Albert Heijn and has substantial operations in the United States, said it was also dealing with a “security issue” in its network, and had taken several systems offline to protect them.

A smartphone app for the retailer told clients that due to a “cybersecurity incident” it was unable to deliver groceries.

Online orders represent around 10% of sales for Albert Heijn. Physical stores remained open and Dutch news agency ANP reported that rivals had seen an influx of delivery orders.

It was not clear if there ‌was any link between the French supermarket attack and the problems flagged by Ahold Delhaize.

Ahold ​is the fourth-largest grocery retailer in the US, where websites for its Stop & Shop, Giant, ‌Hannaford and Food Lion stores all had notices ⁠saying “site temporarily down”.

It was unclear if other operations were affected.

The source close to Lecornu ⁠said ANSSI had identified a vulnerability in software supplied by Danish company Danfoss.

Danfoss said it was “aware of incidents in France affecting a ‌limited number of refrigeration management ​systems”.

The affected units “were running outdated firmware”, Danfoss said, adding ‌that it had “long advised customers to keep supported systems ​updated with the latest firmware and to migrate legacy systems to current-generation solutions”.