A reported cyberattack disrupted refrigeration at several French supermarket chains on October 11-12, 2025.
Why it matters: The incident reportedly affected refrigeration controls at major retailers and may have caused equipment damage and food losses. It also raises questions about legacy systems, contractors, insurance and liability.
- Les Mousquetaires said about 150 Intermarché and Netto stores were affected.
- Reuters cited about 80 Carrefour stores, fewer than 100 Coopérative U stores and roughly 30 Monoprix locations; these are separate chain estimates, not a verified national total.
- Intermarché reported that some refrigeration units reached about 50°C for roughly six hours, but the available material does not establish whether that was an air-temperature reading, a controller setting or another metric.
- Paris prosecutors opened a criminal investigation, while Prime Minister Sébastien Lecornu's office said ANSSI was handling the cybersecurity response.
A reported cyberattack disrupted refrigeration at affected Intermarché, Netto, Carrefour, Coopérative U and Monoprix locations overnight from October 11 to October 12, 2025. BBC reporting published in October 2025 described the impact as involving hundreds of stores and reported food losses.
The retailer figures are separate estimates, not a verified national total:
- Intermarché and Netto: Les Mousquetaires said about 150 stores were affected.
- Carrefour: Reuters cited about 80 supermarkets.
- Coopérative U: Reuters cited fewer than 100 stores.
- Monoprix: Reuters cited roughly 30 locations.
The latter three figures come from a Reuters report republished by Investing.com. They may use different reporting periods or definitions of an affected store, and the material does not establish that every retailer used the same Danfoss system or was affected in the same way.
Intermarché reported that some units reached about 50°C for roughly six hours. The available reporting does not identify who took the measurement, what equipment it referred to, or whether it was a temperature reading, a set point or another metric. It therefore should not be treated as a confirmed storewide air temperature.
Reuters also reported retailer claims of flooded cold rooms, damaged equipment and fires. The material does not assign each incident to a named chain or establish that the fires resulted from the cyberattack. One Intermarché chief executive estimated that food losses could reach €10 million, a projection rather than a confirmed total.
The systems were reportedly Danfoss refrigeration-control systems. Reuters reported that Danfoss said affected units mostly ran outdated firmware. That does not establish the attack vector or show that obsolete firmware was an exploitable vulnerability. Separately, Claroty's October 2025 research identified 2,765 internet-exposed Danfoss interfaces and vulnerabilities affecting the AK-SM 800A platform. Investigators have not confirmed that those vulnerabilities were used.
Reuters reported that Paris prosecutors opened a criminal investigation and that Lecornu's office said ANSSI was handling the response and coordinating with European counterparts. No ransom demand, threat actor or attribution has been publicly reported. The investigation and cybersecurity response were ongoing as of the October 2025 reporting cited here.
By the numbers
- About 150 - Intermarché and Netto stores Les Mousquetaires said were affected
- 2,765 - Internet-exposed Danfoss interfaces identified in Claroty's October 2025 research
- €10 million - Possible food-loss estimate from an Intermarché chief executive, not a confirmed total
Yes, but: The available material does not establish a verified national store count, a common definition of an affected location, the attack vector, or that reported fires and equipment damage were caused by the cyberattack.
What's next: The investigation and cybersecurity response were ongoing as of the October 2025 reporting cited here.