What happened in France?
This is an English adaptation of my post on OT-Cyber.de. Here is the German original.
On the night of 11 to 12 October 2026, refrigeration controllers in supermarkets of several French chains were manipulated remotely. According to BFMTV, as cited by RTBF, the attackers reportedly forced defrosting (RTBF). Fresh and frozen goods had to be thrown away.
- Scope: According to RTBF and AFP, at least 300 stores of Intermarché and Netto are affected, and fewer than 100 stores of Coopérative U. At Monoprix it is around 30 stores, confirmed by the retailers according to AFP (RTBF, AFP).
- Damage: Fresh and frozen goods had to be disposed of.
- Investigation: The Paris public prosecutor's office is investigating. Besides lost goods, RTBF also mentions equipment that had started to catch fire (RTBF).
Still open: the threat actor, the attack path and the affected firmware versions. I track the current status in my incident situation report (German).
Who is affected?
| Affected party | Scope | Status | Source |
|---|---|---|---|
| Intermarché and Netto (Les Mousquetaires) | at least 300 stores | confirmed by the group | RTBF, AFP, franceinfo |
| Système U (Coopérative U) | fewer than 100 stores | confirmed by the group | RTBF, AFP, franceinfo |
| E.Leclerc | several stores | affected according to AFP | AFP |
| Carrefour | 80 supermarkets | confirmed by Carrefour | Reuters |
| Monoprix | around 30 stores | confirmed by the retailers according to AFP | AFP, Je bosse en grande distribution |
Why is this an OT incident?
I'm Max Gilg, an OT cybersecurity expert from Rosenheim. To me this is a textbook case: nobody had to encrypt anything or steal data. Remotely triggered defrost cycles were enough to destroy goods. Refrigeration is OT – a setpoint is a control command with physical effect.
According to reports, no customer data was stolen. A classic IT view would have reported "no data breach" while production was down.
Does this also affect companies in Bavaria, Austria and Switzerland?
Remotely accessible refrigeration is common here too. Typical setups in supermarkets, cold storage facilities and food production sites include:
- Controllers and system managers connected to a remote monitoring service of the refrigeration service provider.
- Permanently open access, often a single account for many sites.
- Nobody on site knows exactly who accesses what and when.
For food companies that fall under NIS2, refrigeration belongs in the risk analysis – and manufacturers of such controllers need to prepare for Cyber Resilience Act (CRA) obligations on vulnerabilities and updates.
What should operators do now?
I map the steps to the SANS Five ICS Cybersecurity Critical Controls:
- CC1 ICS Incident Response: Define how you continue manually and locally if refrigeration is manipulated. Who may disconnect remote control? Who calls the refrigeration technician? Who decides on disposing of goods?
- CC2 Defensible Architecture: Put refrigeration and building systems in their own zone, never directly reachable from the internet.
- CC3 ICS Network Visibility & Monitoring: Get alerts on setpoint and operating mode changes, including at night. An alarm at night, e.g. at 4 a.m., is only worth something if someone responds.
- CC4 Secure Remote Access: Vendor remote access only with approval, a personal account per user, MFA and logging. Close permanently open tunnels.
- CC5 Risk-Based Vulnerability Management: Know the firmware versions of your controllers and prioritize updates by physical impact. EoL controllers no longer get updates: replace them or disconnect them from the internet.
My recommendation: This week, ask your refrigeration service provider who can access your controllers tonight. If the answer takes longer than one sentence, you have your first action item.
With AI, asset inventory and analysis of remote access logs are feasible even for small teams – focusing on these five controls delivers more than any single product.
How I can help
With an OT asset inventory we find out which refrigeration and building systems are reachable. With OT security consulting and attack detection in OT networks we secure remote access and make altered setpoints visible. In an acute incident: OT emergency help, across DACH.
If your maintenance and engineering teams need to recognise these risks: Cyber-Awareness für Instandhaltung und Technik.
Corrected on 14 October 2026: outdated status information, temperature values and an unverified company statement removed.
Original (German): https://ot-cyber.de/blog/kuehlung-gehackt-was-lebensmittelbetriebe-in-dach-tun.html
Max Gilg is an OT cybersecurity consultant based in Rosenheim, Germany (OT-Cyber.de).
Top comments (0)