Hackers turned refrigerated cases at hundreds of French supermarkets into something closer to ovens overnight Sunday. They drove temperatures as high as 50C (122F), spoiled fresh and frozen stock and, according to Paris prosecutors, sparked fires.
The attack ran through the night of Oct. 11–12 and hit refrigeration control systems made by Danish engineering group Danfoss. The attackers didn’t cut the cooling. Instead, they reportedly hijacked a routine maintenance setting and locked units into a nonstop defrost cycle. Les Mousquetaires, owner of the Intermarché chain, said affected cases ran hot for about six hours.
The group said roughly 150 Intermarché stores were hit and that all fresh and frozen product at those locations was thrown out. Some French media reports put the group’s total closer to 300 once its Netto discount stores are included. Coopérative U said almost 100 of its stores were affected. Broadcaster BFM TV reported that E.Leclerc, France’s largest grocer, was also caught up.
Coopérative U CEO Dominique Schelcher posted on X that targeting equipment essential to keeping the country’s food fresh was “unprecedented” and “unacceptable.”
French press reports say Les Mousquetaires puts its losses in the millions of euros. Individual store managers have described write-offs from about €50,000 to more than €200,000 per location.
Paris prosecutors have opened an investigation into what they called a “large-scale” attack. Prime Minister Sébastien Lecornu has asked France’s national cybersecurity agency, ANSSI, to investigate. His office said France is coordinating with European partners because other countries may also be exposed.
A source close to Lecornu said ANSSI had found a vulnerability in Danfoss software. Danfoss said it was aware of incidents affecting “a limited number” of French systems running outdated firmware. It added that it had long urged customers to update and retire legacy equipment.
US operators had been warned. In May 2025, the Cybersecurity and Infrastructure Security Agency published an advisory on an authentication flaw in Danfoss’s AK-SM 800A system managers, which run supermarket refrigeration. In August this year, researchers at Claroty’s Team82 unit detailed further flaws in the same platform, which Danfoss has since patched. They also reported thousands of the controllers reachable from the open internet, and found similar weaknesses in Copeland’s XWEB Pro controllers. Investigators haven’t said whether any of those specific flaws were used in France.
That should concern operators in the US. Danfoss runs its North American business from Baltimore, and the US has been described as its largest single-country market. So far there’s no indication that any US store has been hit.
Intermarché has already warned that some of its policies may not cover this kind of in-store incident. US policyholders could run into the same problem.
Spoilage endorsements on commercial property policies are typically written around power outages or mechanical breakdown. But property carriers have spent years tightening cyber exclusions. Gallagher’s John Farley has told Insurance Business that traditional property policies often carve out cyber-related physical damage, while standalone cyber policies vary widely on whether they cover property damage at all. A walk-in cooler full of ruined meat could fall straight into that silent cyber gap.
Physical damage caused by a cyber attack can be insured, but generally only when the business buys that cover deliberately. That can mean an endorsement on the cyber program or a dedicated cyber-property product.
There’s a subrogation angle, too. Les Mousquetaires has reportedly said the systems were managed by Danfoss. Any carrier that pays a claim may therefore look at recovering its costs from further up the chain.
Read next: Jaguar Land Rover failed to finish cyber insurance purchase
US food retail has been hit before, though on the IT side. Last year’s attack on distributor United Natural Foods cut up to $400 million from its sales and left Whole Foods shelves bare, and the company said it expected its cyber insurance to cover the incident.
Separately, Ahold Delhaize, the Dutch group that also owns Food Lion, Stop & Shop and Giant, said Monday it was dealing with a “security issue” affecting its stores in the Netherlands and Belgium. No link to the French attack has been established, and the reported disruption centered on its European chains.
The French attack was different. The attackers ignored the data and went straight for the physical stock.
Brokers with grocery, cold-storage and food distribution clients may want two answers this week. Is the refrigeration control equipment connected to the internet, and is it patched? And which policy pays if someone sets it to 122F?
Read next: What UK retail breaches mean for the global cyber insurance market
