Short answer
On the night of October 11 to 12, 2026, attackers altered refrigeration controls at hundreds of French supermarkets, including Intermarché, Carrefour and E.Leclerc stores. French authorities say the attacker is unknown, and no customer data has been reported exposed.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc |
|---|---|
| Incident type | Supply-chain compromise |
| Status | Confirmed by authorities |
| Sector | Retail (supermarkets and refrigeration systems) |
| Country | France |
| Detected | 2026-10-12 |
| Disclosed | 2026-10-13 |
| People or records affected | About 700 of France's 10,000 supermarkets, according to Finance Minister Roland Lescure. Other reports give lower store counts per chain. |
What data was exposed
- No customer or personal data has been reported as exposed. The attack changed temperature and defrost settings on store refrigeration units.
What happened
During the night of October 11 to 12, 2026, attackers compromised remote control systems for refrigeration in French supermarkets. According to INCIBE-CERT, which summarizes the French CERT-FR update, they altered temperature and defrost settings, leaving some fridges and freezers at up to 50°C for hours. Stores threw out fresh and frozen food, and small fires broke out at some sites.
This is not a customer data breach as far as any source we opened reports. We cover it because shoppers and store staff are likely targets of copycat scams, and because the incident shows how one shared equipment weakness can hit several rival chains at once.
Which chains and how many stores
Reports name Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc. Counts differ:
- Finance Minister Roland Lescure told parliament about 700 of France’s 10,000 supermarkets were affected, The Korea Times reports.
- Al Jazeera cited at least 300 Intermarché and Netto stores, more than 100 Coopérative U stores, 80 Carrefour stores, and about 5% of Monoprix’s roughly 490 stores.
- The Korea Times quotes Coopérative U as saying 80 of its 2,000 stores were affected, most of which avoided refrigeration failures. That differs from Al Jazeera’s figure for the same chain.
We do not have an official breakdown, so treat all store counts as approximate.
What officials disclosed
CERT-FR’s October 13 update confirmed “numerous compromises” involving Danfoss, Copeland and Dixell controllers and warned the campaigns were probably still active. It recommended removing direct internet exposure, restoring compromised equipment, updating firmware, changing default passwords and allowing access only through a protected network.
Danfoss told AFP that most affected units were “legacy” products with “outdated firmware” and that it had urged updates earlier, Al Jazeera reports. The Paris prosecutor’s cybercrime unit is investigating, according to The Korea Times. Lescure said there was no risk to France’s food supply.
What is still unknown
Nobody has been publicly identified as the attacker, and authorities have not said how the intruders first reached the controllers. Estimates of losses range up to tens of millions of euros in INCIBE-CERT’s summary, and Al Jazeera says the exact amount is unclear.
Scam angle
Big, visible disruptions invite fake “compensation” and “recall” messages. Our guides on phishing messages, online shopping scams and government impersonation scams show how these pitches work. If you ever do hand over details, follow these steps. Other incidents are in our breach archive.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake 'food recall' or 'compensation' texts and emails using a supermarket's name to collect card details.
- Look-alike loyalty-card or refund pages claiming to repay customers for spoiled goods.
- Phishing aimed at store and supplier staff, posing as the retailer's IT team or the refrigeration manufacturer, asking for logins or firmware 'updates'.
- Cold calls from people posing as security agencies who ask business owners to open remote access to their equipment.
What to do if you are affected
- 01Treat unexpected refund, recall or compensation messages from a supermarket as suspect. Go to the retailer's official site or app yourself.
- 02Never enter card details or loyalty-account passwords from a link in a message about this incident.
- 03Business owners with internet-connected refrigeration controllers should disconnect them from the internet or restrict access, as the French authorities advise.
- 04Apply current firmware, change default passwords, and allow access only through a protected network.
- 05Retail staff should verify any IT or vendor request through a known phone number before sharing credentials.
Frequently asked questions
Which French supermarkets were hit by the cyberattack?
Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc were named in reports, according to INCIBE-CERT and Al Jazeera.
Was customer data stolen in the French supermarket cyberattack?
No source we reviewed reports stolen customer data. The attack targeted refrigeration controllers, not customer databases.
How did hackers attack the supermarket fridges?
CERT-FR said remote control systems for refrigeration were compromised and temperature and defrost settings changed. Al Jazeera reports Danish maker Danfoss said most affected units were legacy products with outdated firmware.
How many French supermarkets were affected?
Finance Minister Roland Lescure told parliament about 700 of 10,000 supermarkets. Al Jazeera cited at least 300 Intermarché and Netto stores, more than 100 Coopérative U stores and 80 Carrefour stores. Counts differ by source.
Who is behind the French supermarket cyberattack?
Nobody has been publicly identified. CERT-FR says no perpetrators have been named, and a Paris investigation is under way.
Sources
- Cyberattack on Supermarket Refrigeration Systems in France, INCIBE-CERT (citing CERT-FR update of 13 October 2026), 2026-10-13
- French fridge fright: Why supermarkets have become target for hackers, Al Jazeera, 2026-10-13
- Cyberattack targeting refrigeration systems hits 700 supermarkets, French govt says, The Korea Times, 2026-10-14
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.