Hackers Turn Up EU Supermarket Freezers, Wasting Tens of Millions of Euros’ Worth of Food

Hundreds of stores hit, temperatures reaching 50°C and food dumped overnight. Could Australia and New Zealand’s supermarket freezers be sitting ducks?

Tens of millions of euros in estimated losses, hundreds of supermarkets affected and refrigeration systems reportedly heated to 50°C for six hours. A cyberattack on French food retailers has turned the equipment protecting fresh and frozen stock into the means of destroying it. Intermarché chief executive Thierry Cotillard estimated nationwide losses would reach tens of millions of euros in a single day. The final bill and how much represents food rather than other damage, has yet to be established.

The attack struck overnight on 11–12 October. Later reporting by Le Monde identified around 300 Intermarché and Netto stores, 100 Coopérative U outlets, 80 Carrefour stores and approximately 30 Monoprix locations, alongside stores in the E.Leclerc network. Those figures suggest roughly 500 outlets across the named groups, although the count remains provisional. One Intermarché owner in Gradignan reported €21,000 in lost stock at purchase price. Two supermarkets in Alsace reportedly suffered combined stock losses of €270,000—a glimpse of how quickly the damage adds up.

Attackers reportedly forced refrigeration equipment into prolonged defrost cycles, allowing temperatures to climb and leaving retailers to discard affected food. Danfoss, the Danish supplier of the controllers involved, said most affected units were obsolete products or current models running outdated firmware. Its AK-SM800 systems reached end-of-life in 2021, while AK-SC355 systems were phased out in 2016; neither still receives software or security updates. The company says it is helping customers update supported equipment and strengthen network protection.

France’s official cybersecurity agency, CERT-FR, has confirmed numerous compromises involving Danfoss AK-SM and AK-SC controllers. Its immediate advice is to disconnect or restrict access to affected systems, followed by recovery measures including security updates and credential changes. The warning exposes a serious weakness in connected food infrastructure: equipment that can be adjusted remotely also needs protection against someone remotely taking control.

Could ANZ supermarket chains be sitting ducks? That depends on their equipment, software and access controls. PFN has found no evidence establishing that Australian or New Zealand supermarket chains share the specific exposure behind this attack. But the broader risk is already recognised locally. New Zealand’s National Cyber Security Centre says it has identified internet-connected operational technology devices in the country. Australian government guidance warns that exposed industrial systems are likely to be discovered and targeted, and calls for remote access to be controlled and monitored.

The potential bill stretches beyond discarded food. Repairs, replacement stock, interrupted trading and insurance disputes could compound the losses. For consumers, the consequences could include gaps on shelves and disrupted access to fresh food. For producers, every discarded pack also represents wasted ingredients, energy, labour and transport. Europe’s attack has demonstrated how quickly a digital intrusion can become a physical food-waste crisis and why protecting the food supply now includes protecting the controls that keep it cold.

No person or group had claimed responsibility at the time of reporting, and the attackers’ identity and motive remain unknown.