A major cyberattack targeting refrigeration systems across hundreds of French supermarkets has highlighted the growing cybersecurity risks associated with connected operational technology (OT). The incident, reported on 12 October 2026, disrupted refrigeration operations across several major retailers, resulting in food losses, reports of equipment damage and significant operational disruption.
Unlike conventional cyberattacks focused primarily on data theft or IT infrastructure, this incident involved the manipulation of equipment responsible for physical processes. It demonstrates how compromised operational technology can directly affect essential business functions, raising important questions about network security, remote access and the resilience of connected infrastructure.
As organisations increasingly connect operational systems to wider networks, the attack serves as a reminder that OT cybersecurity is not simply about protecting digital information. It is also about protecting the physical systems and services that businesses depend on.
Hundreds of French Supermarkets Affected
The attack affected several major French supermarket chains, including Intermarché, Netto, Carrefour, Coopérative U, Monoprix and E.Leclerc. According to reporting from Le Monde, approximately 300 Intermarché and Netto locations were affected, alongside around 80 Carrefour stores, approximately 30 Monoprix locations and several E.Leclerc supermarkets. These figures remain provisional, with earlier reports citing different totals as the scale of the incident became clearer.
Coopérative U CEO Dominique Schelcher separately confirmed that 80 of the retailer’s approximately 2,000 stores had been affected. However, rapid intervention by employees and refrigeration specialists helped prevent serious cold-chain disruption at most of those locations.
The severity of the impact varied considerably. Some supermarkets experienced significant food spoilage and were forced to dispose of fresh and frozen products, while others were able to contain the disruption before major losses occurred. The total financial impact has not yet been established. Schelcher indicated that losses at individual hypermarkets could potentially reach €200,000, although this was an estimate rather than a confirmed assessment of the damage.
The incident illustrates how a cyberattack affecting operational infrastructure can create substantial financial and logistical challenges, even where the disruption is relatively short-lived.
How Were the Refrigeration Systems Targeted?
The attack involved connected refrigeration management systems used to monitor and control cooling equipment across supermarket locations. According to Reuters, attackers manipulated refrigeration controls, causing temperatures to rise to approximately 50°C at some locations. Le Monde also reported that automated defrost cycles were extended from approximately one hour to eight hours, interfering with normal refrigeration operations and delaying the detection of abnormal conditions.
At an individual Intermarché location, temperatures reportedly reached 80°C, causing some equipment to melt. This was a particularly severe reported example and should not be interpreted as representative of every affected store. These details illustrate how malicious interference with operational controls can translate directly into physical disruption. Instead of simply preventing employees from accessing computer systems, attackers were reportedly able to change the behaviour of equipment responsible for maintaining essential operating conditions.
However, the precise initial intrusion method remains unconfirmed in official public findings. Although attention has focused on weaknesses associated with refrigeration management software and outdated equipment, no particular vulnerability has been conclusively established as the method used to gain access.
French Cybersecurity Authorities Issue Official Warning
On 12 October 2026, France’s national computer emergency response team, CERT-FR, published an official security alert concerning numerous compromises involving Danfoss AK-SM and AK-SC refrigeration management systems. The alert, CERTFR-2026-ALE-012, identifies the affected product families and highlights the risks associated with exposing equipment management interfaces directly to the internet. CERT-FR advises organisations to disconnect or restrict network access to potentially affected systems. Where compromise is suspected, its recommendations include restoring equipment to factory settings, applying available security updates, rotating credentials, reviewing user accounts and securely reconfiguring devices.
The guidance reinforces the importance of maintaining appropriate access controls around operational equipment, particularly where remote management capabilities are required. The Paris prosecutor’s office has also opened an investigation into the attack, with France’s national cybersecurity agency, ANSSI, instructed to examine the incident. At the time of writing, no verified public findings have established the identity of the attackers or the precise technical method used to gain initial access.
Read the official CERT-FR security alert.
Legacy OT Infrastructure Raises Security Concerns
The incident has drawn attention to the cybersecurity challenges associated with ageing operational technology. Danfoss, whose refrigeration management equipment was identified in connection with the incident, indicated that many of the affected units were older products that had reached the end of their supported lifecycle or were running outdated firmware.
According to a statement reported by Cooling Post, affected systems included the AK-SM800, which reached end of life in 2021, and the AK-SC355, which was phased out in 2016. The manufacturer also identified affected AK-SM800A systems running outdated firmware. Danfoss stated that it was working with customers on appropriate mitigation measures, including firmware updates where available, stronger network protections and reducing direct internet exposure.
This highlights a longstanding challenge within OT environments. Industrial and operational equipment is often designed to remain in service for many years, with organisations prioritising reliability and continuity over frequent replacement. However, as older systems become connected to modern networks, they may introduce security risks that were not considered when the equipment was originally deployed.
For organisations relying on legacy infrastructure, understanding which devices are connected, how they communicate and whether they remain supported is an important part of managing operational risk.
The Wider Business Impact of OT Cyberattacks
The consequences of the French supermarket attack extended beyond the immediate technical disruption. Refrigeration equipment is essential to maintaining food safety and protecting perishable stock. When these systems fail or operate outside expected conditions, businesses may face product losses, operational downtime and significant recovery costs.
The incident also highlighted potential risks within wider supply chains. Le Monde reported that French wholesaler Metro had been affected through an external service provider, while industry organisation Culture Viande indicated that at least two of its members had experienced disruption. These reports demonstrate how operational technology incidents can affect multiple organisations and service relationships, rather than remaining isolated to a single business.
The implications are relevant to other industries that depend on connected physical infrastructure, including manufacturing, energy, healthcare, logistics and transport. Although the technologies and operational requirements differ, the underlying cybersecurity challenge is similar. Unauthorised access to operational systems can create consequences that extend beyond IT environments and directly affect business continuity.
Why Network Visibility Matters for OT Security
As operational technology becomes increasingly connected to enterprise IT infrastructure, organisations face greater challenges in understanding and securing their network environments. OT systems often include specialist controllers, legacy devices and communications that differ from conventional enterprise IT networks. Without sufficient visibility, identifying unusual connections, unexpected traffic patterns or potentially malicious activity can become more difficult.
Network observability and Network Detection and Response (NDR) technologies can support security teams by providing greater insight into how devices communicate and identifying activity that may require investigation.
For example, unexpected connections to operational management systems, unusual communications between devices or suspicious external traffic may provide indicators of potential compromise. However, network monitoring alone cannot guarantee the detection or prevention of attacks against physical control systems. Effective OT security also depends on secure remote access, appropriate network segmentation, asset management, supported equipment and coordinated incident response procedures.
The French supermarket incident reinforces the importance of combining these measures to improve operational resilience and reduce unnecessary exposure.
Strengthening Network Security With Telesoft IntSOC
The attack highlights the importance of understanding network behaviour across connected infrastructure, particularly where security incidents can have physical and operational consequences. Telesoft’s IntSOC platform combines high-performance network observability with AI-powered Network Detection and Response, helping organisations gain deeper visibility into network communications and identify suspicious activity.
Designed for high-speed network environments, IntSOC provides network observability and threat detection capabilities that can support security teams investigating anomalies, unusual communication patterns and potential network threats. Through network-level monitoring and AI-driven detection capabilities, IntSOC can contribute to a broader cybersecurity strategy focused on improving threat awareness and supporting security investigations.
For organisations managing complex IT and OT environments, network visibility can be an important component of understanding potential risks and strengthening overall security operations. However, any deployment in an OT environment must account for the specific network architecture, protocols and operational requirements involved. Network Detection and Response should complement established OT security controls rather than replace them.
Conclusion: OT Cybersecurity Is a Business Continuity Priority
The October 2026 cyberattack affecting French supermarket refrigeration systems demonstrates how cybersecurity incidents can extend beyond traditional IT environments and create significant consequences for physical operations. With hundreds of supermarket locations affected, financial losses reported and official investigations underway, the incident highlights the importance of securing connected operational infrastructure. Although the attackers and precise initial intrusion method remain unidentified in official public findings, the wider implications are clear. Organisations must understand the risks associated with legacy equipment, remote access and increasingly interconnected operational systems.
As cyber threats continue to evolve, maintaining network visibility, identifying suspicious behaviour and implementing appropriate security controls will remain essential to protecting operational environments and supporting business continuity.
Strengthen Your OT Cybersecurity With Telesoft
As cyber threats increasingly target connected operational infrastructure, organisations need greater visibility into their networks to understand potential risks and respond effectively to suspicious activity. Telesoft’s IntSOC platform combines high-performance network observability with AI-powered threat detection, helping organisations gain deeper insight into network communications and strengthen their wider cybersecurity strategy.
To learn more about how IntSOC could support your organisation’s network security requirements, speak to our team today.
Go Back
