Hackers Sabotage Refrigeration Controllers at Hundreds of French Supermarkets, Raising Questions About Cyber Cover for Spoiled Food

A cyberattack on French supermarkets has targeted something very different from customer data: the fridges. According to a report published by Insurance Journal on October 21, 2026, attackers accessed centralised, internet-connected refrigeration controllers, the systems that contractors use to monitor temperatures, and changed settings to trigger prolonged defrost cycles. The result was that fridges and freezers heated up, putting stocks of chilled and frozen food at risk across a large number of stores.

The report gives store counts rather than customer figures. Groupement Mousquetaires, the group that owns the Intermarché chain, said 300 of its stores were attacked. Carrefour said 80 supermarkets were affected. Coopérative U was also named as affected, though no separate count is given. The article says that the disruption hit 700 stores across Intermarché, Coopérative U and Carrefour. The date of the attack is not stated outright. The article refers to a store manager arriving "last Monday", and an accompanying photograph is dated October 12, 2026, so the incident probably occurred around that date.

Danfoss, a manufacturer whose equipment was affected, said most of the compromised devices were "obsolete models that no longer received software or security updates". That detail points to a common weakness. Industrial and building equipment is often installed for decades, may be connected to the internet for remote monitoring, and may not receive security patches once the manufacturer stops supporting it. No group has publicly claimed responsibility for the attack, so the motive is unknown. The sources reviewed do not say whether a ransom was demanded.

The financial impact on individual stores can be seen from one example. Store manager Jérémy Béziaud told the reporters that he threw out €3,000 ($3,370) of products. "I didn't want to take any risks since the cold chain had been broken," he said. The cold chain is the continuous refrigeration needed to keep food safe from production to sale, and food-safety rules typically require products that have been above safe temperatures for too long to be discarded. Multiplied across hundreds of stores, such losses could be significant, though the article does not provide an aggregate estimate.

An academic, Lallie of the University of Warwick, was quoted saying hackers are "targeting retail because they're weak and it can have a massive impact on society." The remark reflects a broader trend. Retailers hold large volumes of payment and personal data, operate on thin margins and rely on just-in-time supply chains, making disruption costly. An attack on refrigeration does not need to steal anything to create a loss.

The article carried no discussion of insurance, but the topic follows naturally. It links to another piece headlined "Insurers: French Supermarkets' Cyber Insurance Unlikely to Cover Food Losses". That article was not reviewed for this report, so its contents are not described here, but the headline captures a key issue. Standard cyber policies cover losses such as data restoration, ransom payments, business interruption caused by system failure and legal costs. Whether they cover physical damage to stock is less clear. Many cyber policies exclude or limit physical damage to tangible property, and many property policies exclude spoilage caused by cyber events or require that the cause be a specified peril such as power failure or equipment breakdown. Some policies offer "stock spoilage" or "contamination" extensions, and some add "cyber physical" cover, but the terms vary. The result is a potential gap between cyber and property insurance, which insurers refer to as "silent cyber" when coverage is unclear.

It is also worth separating what is known from what is not. The report establishes the method of attack, the equipment type, the companies that confirmed disruption and a sample loss from one store. It does not establish who carried out the attack, how long the disruption lasted, how many tonnes of food were discarded, whether any customers were affected or whether regulators have opened an investigation. The 700-store figure combines statements from different companies and the publication's own summary, and some stores may have been affected more severely than others. Until the companies publish fuller accounts, estimates of the total cost should be treated as speculation.

For the retailers, the practical lessons are to identify which operational technology devices are connected to the internet, to isolate them from corporate networks, to change default credentials, to replace unsupported equipment and to ensure that contractors' remote access is protected by strong authentication. Businesses should also check their insurance policies for how they treat spoilage caused by a cyber event, and talk to brokers about extensions. Food retailers might also consider backup temperature monitoring that does not rely on the same network.

For regulators and policymakers, the incident is another example of attackers moving from information technology to operational technology. A Google Cloud outage in London affected UK banks on October 20, illustrating a different type of dependency on shared technology. Both episodes show that essential services can be disrupted by a single point of failure or an insecure device.

For customers, the immediate effect appears limited to temporary stock losses and possible product shortages at affected stores; the article does not report food-safety incidents or recalls. It also does not report any data being exposed. Details such as the identity of the attackers, the full cost and the insurance response are not yet known, and further reporting is likely to clarify them. Readers should treat the store counts as company statements and the 700-store figure as the publication's summary.