What managed service providers can learn from the 2026 French supermarket attacks

Attacks on refrigeration systems at hundreds of French supermarkets show why securing connected operational technology (OT) requires protecting the physical outcome, not just the system.

Key takeaways

• Connected operational systems can turn cyberattacks into physical disruption. The French supermarket incidents show how compromised refrigeration-management systems can put inventory, operations, and business continuity at risk.
• Initial access and attribution remain unresolved, but the security lessons are already clear. Internet exposure, weak authentication, outdated software, and poorly controlled third-party access are risks that managed service providers (MSPs) can address without waiting for investigators to determine exactly how the attacks occurred.
• Protect the outcome, not just the system. MSPs should understand which connected systems can affect physical processes, who has access to them, how critical conditions will be detected independently, and who can intervene when something goes wrong.

During the night of October 11–12, 2026, attackers remotely manipulated refrigeration systems at hundreds of supermarkets in France, raising temperatures and disrupting refrigeration operations. Several major French retailers were affected, including Intermarché, Netto, Coopérative U, Carrefour, Monoprix, and E.Leclerc. French Finance Minister Roland Lescure said about 700 stores were affected by the attack, and that the incident was an attack on the French food supply chain. 

France’s response involved several layers and extended beyond the affected retailers. The country’s cybersecurity agency, ANSSI, became involved in the technical response and coordinated with European counterparts. Separately, the Paris prosecutor’s cybercrime unit opened a criminal investigation. Prime Minister Sébastien Lecornu was reported to be personally monitoring the situation.

Affected retailers and refrigeration specialists worked to restore refrigeration systems and protect inventory.

The devices at the center of the French investigation

The attack reportedly compromised systems responsible for monitoring and controlling commercial refrigeration. As temperatures increased, refrigeration equipment and the refrigerated inventory were put at risk.

Public reporting has associated the incident with five products:

Reporting does not establish which devices were used in which stores.

These devices give operators a centralized way to monitor refrigeration equipment, receive alarms and, depending on the system and configuration, manage or control aspects of its operation. 

Capabilities differ across systems, but they all occupy a supervisory layer in a commercial refrigeration environment. From a defender's perspective, the devices are part of the same attack surface.

Systems like these often connect to networks managed or secured by IT teams and MSPs. Refrigeration specialists may remain responsible for operating and maintaining the equipment, while responsibility for network security and access controls sits elsewhere.

At Coopérative U, CEO Dominique Schelcher described this type of third-party relationship, explaining that the stores were “not direct customers of Danfoss … We are customers of refrigeration manufacturers who provide us with this solution.”

For MSPs, that makes the division of responsibility a security question, not just an operational one:

• Who administers and maintains the system?
• Who has access, and how do they connect?
• Who is responsible for securing that access?
• Who is responsible for securing the system itself?

Responsibility for the network, the refrigeration system, and the physical response may cross organizational boundaries. Those boundaries need to be understood before an incident, not discovered during one.

Initial access and attribution remain unresolved

Public reporting has not confirmed the threat actor and initial-access method. Several vulnerabilities may have been present in the named devices, but preliminary assessments indicate the software vulnerabilities were not used in the compromise.

Internet exposure is another story. Researchers at Censys identified 1,825 internet-visible Danfoss StoreView control panels in France on October 11. These devices were at different patch levels and states of vulnerability. 

By October 14 that number had fallen to 537. The decline was visible across patch levels, consistent with operators taking systems off the public internet rather than simply patching vulnerable devices.  

The unresolved questions do not prevent organizations from acting on the risks already visible. Internet exposure, weak authentication, outdated software, and poorly controlled third-party access are risks that can be addressed while an investigation is underway.

Different stores, different outcomes

The attack did not produce the same outcome at every store. Some locations lost inventory, while others detected the temperature changes and intervened before products were lost. The differences offer a useful look at how the same type of cyber-physical disruption can produce very different consequences. Here’s what public reporting tells us about each retailer.

Intermarché and Netto

Intermarché and Netto are sister brands within Groupement Mousquetaires, which reported some of the largest impacts from the refrigeration attacks.

• Scale: More than 300 locations across the two brands were affected.
• Third-party involvement: Groupement Mousquetaires said the attack affected a service provider involved in managing refrigeration systems at some stores, providing important evidence of the third-party layer in the refrigeration ecosystem.
• Physical impact: Refrigeration equipment at some Intermarché locations was reportedly put into defrost mode, with temperatures reaching as high as 50°C (122°F). Affected fresh and frozen products were removed and discarded.
• Equipment: Public reporting associated affected Groupement Mousquetaires locations with Danfoss refrigeration-management equipment, but available evidence does not establish which specific Danfoss models were deployed at individual Intermarché or Netto stores.
• Financial impact: Groupement Mousquetaires said losses associated with roughly 180 stores were expected to reach several million euros.

Coopérative U

Coopérative U reported uneven impacts across its stores, particularly in whether locations could preserve the cold chain. The group’s grocer banners include Super U, Hyper U, and U Express.

• Scale: CEO Dominique Schelcher said on October 13 that 80 of the group's approximately 2,000 stores had been affected. Super U and Hyper U were identified in reporting. Impact on U Express has not been confirmed.
• Third-party involvement: Coopérative U teams worked with refrigeration specialists to restore operations but did not say whether these specialists managed the compromised systems before the attack.
• Physical impact: Most of the 80 affected stores reportedly maintained the cold chain, while a minority were unable to respond quickly enough and lost goods.
• Equipment: Reporting does not identify which of the compromised products were used at the affected locations.
• Financial impact: Losses could range from several tens of thousands of euros at a smaller store to as much as €200,000 at a larger hypermarket.

Carrefour

Carrefour reported a relatively limited impact across its broader store network, while retailer-specific technical details remain scarce.

• Scale: Carrefour said 80 of its supermarkets were affected, while the vast majority of its roughly 6,000 stores were unaffected.
• Physical impact: There are few details about the impact on refrigeration units, though Carrefour locations were included in the reporting about disrupted refrigeration and elevated temperatures.
• Other details: Public reporting has not established the equipment involved, third-party involvement, or financial impact.

Monoprix

Public reporting confirms Monoprix was affected but provides comparatively little detail about what happened inside individual stores.

• Scale: Approximately 5% of roughly 490 Monoprix stores were affected by the attacks.
• Physical impact: Monoprix was included in broader reporting about disrupted refrigeration and elevated temperatures. Details are unknown or unconfirmed.
• Other details: Public reporting has not established the equipment involved, third-party involvement, or financial impact.

E.Leclerc

E.Leclerc provides some of the clearest reporting on how the attack affected refrigeration settings and how different stores experienced different physical outcomes.

• Third-party involvement: The attack affected a third-party refrigeration-equipment supplier, with consequences for refrigeration systems in several stores. The supplier was not publicly identified in that statement.
• Physical impact: E.Leclerc described “forced defrosting of the refrigeration systems in numerous stores.” At one affected location, a refrigeration specialist reported that a frozen-goods setting was changed from −22°C to 150°C, with settings changing two or three times per second. The specialist interpreted the rapid changes as appearing automated.
• Equipment: Dixell equipment was in use at one or more of the affected locations.
• Other details: Public reporting has not established the scale or financial impact.

Together, the retailer figures publicly reported here account for roughly 500 stores, compared with the French government's later estimate of approximately 700 affected locations. The gap reinforces that publicly available retailer-by-retailer reporting provides only a partial accounting of the incident.

Similar symptoms do not mean the same cause

Just as similar attacks can result in different outcomes, similar-looking incidents can have different causes. Incidents reported by Hannaford stores and U.S. military commissaries drew attention because of their timing or similarities, but neither has been publicly established as part of the French attacks.

Hannaford

The timing of the disruptions at Hannaford makes the comparison with France especially striking. The French refrigeration attacks occurred overnight on October 11–12. On October 12, Hannaford’s Dutch parent company, Ahold Delhaize, disclosed that it was responding to a cybersecurity incident. The company subsequently said malicious activity in its IT infrastructure led it to proactively take websites, apps, and other services offline, while physical stores remained open.

Some Hannaford stores also experienced refrigeration problems, prompting speculation about a possible connection with the events in France. However, no authoritative evidence has connected the Ahold Delhaize cyberattack or the Hannaford refrigeration problems to the attacks in France.

U.S. military commissaries

The U.S. military incidents provide an even more intriguing comparison because they preceded the French attacks. On August 28, Air Force Times reported refrigeration disruptions in at least seven U.S. military installations. The Department of Defense acknowledged a possible refrigeration disruption at some Defense Commissary Agency locations without identifying its cause. At Fort Huachuca, an “overnight equipment failure" reportedly caused all freezers to enter defrost mode and spoiled frozen food. 

Although some researchers immediately suspected an attack, officials initially provided few details about the cause of the disruptions. On October 29, Reuters reported that the Pentagon was treating the freezer malfunctions as a suspected cyberattack, although no connection to the attacks in France has been confirmed.

A key takeaway here is investigative discipline. Similar timing or symptoms may justify looking for a connection, but they do not establish one. Preserve the evidence, establish the timeline, and determine the root cause before attributing an operational failure to malicious activity or connecting it to another incident.

Cyber-physical resilience

The French supermarket attacks show why cybersecurity controls and cyber-physical resilience are related but distinct. Traditional cybersecurity controls are designed to prevent, detect, contain, and recover from compromises of digital systems. In cyber-physical environments such as refrigeration, however, a digital compromise can also produce physical consequences.

The two disciplines are therefore complementary. Strong authentication, secure administrative access, patching, and other security measures can reduce the likelihood of compromise. Cyber-physical resilience asks what happens next: If those defenses fail, what prevents a cyber compromise from becoming a physical loss?

We can make this distinction clearer by placing these controls side-by-side: 

The two sets of controls address different sides of the same risk. MSPs already apply this principle in server rooms and other spaces that house IT equipment. Securing the technology does not eliminate the need to monitor temperature, power, smoke, or water. Connected operational systems extend the same principle to environments where technology controls a physical process.

Independent and out-of-band alerting

Refrigeration-management platforms can provide extensive monitoring and alarm functions. But when the same environment both controls and monitors a physical process, a critical question arises: Can dangerous conditions still be detected and communicated if that environment becomes unavailable or can no longer be trusted?

Where the potential consequences justify it, independent or out-of-band monitoring provides another way to observe the physical process. In this context, out-of-band monitoring means observing and communicating physical conditions through a path that does not depend on the primary refrigeration-management environment. The system capable of creating a dangerous condition should not be the only system capable of reporting it.

Protect the outcome, not just the system

Detection alone is not resilience. An alert does not protect a freezer full of food. Someone must receive the warning, understand what it means, and have the authority and expertise to intervene.

In a conventional cyber incident, an MSP might isolate an endpoint, disable an account, block network traffic, or take a system offline. When technology controls a physical process, those actions can have operational consequences. MSPs therefore need to understand not only who owns the technology, but who understands the physical process and can intervene safely. In a refrigeration environment, that may require coordination among IT or security teams, store or facilities personnel, and refrigeration specialists. Those responsibilities, escalation paths, and decision-making authority should be established before an incident occurs.

Ultimately, the goal is to protect the business outcome. A changed configuration value does not spoil inventory on its own. The loss occurs when that change progresses through the physical process far enough to affect refrigeration conditions and, eventually, the food being protected.

For MSPs, the approach begins with the outcome that cannot be allowed to fail. Work backward from there. What technology can affect it? How will the organization know conditions are deteriorating? Who receives the warning, and who can intervene?

What MSPs should do next

The French supermarket attacks show how devices outside the traditional IT stack can still sit on customer networks, depend on remote access, and create physical and business consequences when something goes wrong. MSPs do not need to become refrigeration specialists, but they should understand where their responsibilities intersect with the connected systems their customers depend on.

• Know what’s connected. Identify operational, building-management, environmental, and other specialized systems connected to customer networks. Understand what those systems control and what could happen if they become unavailable or are manipulated.
• Establish ownership. Determine who owns, operates, and maintains each system, and who is responsible for securing it. The customer, MSP, equipment vendor and specialized service provider may each be responsible for different parts of the environment.
• Map third-party access. Know which vendors and service providers can access connected systems, how they connect, what privileges they have, and who is responsible for securing that access.
• Reduce unnecessary exposure. Identify management interfaces that are directly accessible from the internet and eliminate that exposure where it is not required. Where remote administration is necessary, protect access with appropriate authentication and secure remote-access controls.
• Plan for physical consequences. Before isolating, shutting down or otherwise containing a compromised operational system, understand what that action could do to the physical process it controls. Include facilities personnel, equipment specialists, or other operational experts in incident-response planning where appropriate.
• Define who can intervene. Establish escalation paths before an incident occurs. An MSP may detect suspicious activity, but responding to the physical consequences may require equipment specialists, facilities personnel, or someone with authority at the customer site.
• Preserve evidence and determine root cause. Similar symptoms are useful investigative leads, not proof of a common cause. Preserve relevant logs and other evidence, establish a timeline, and determine what happened before attributing an operational failure to malicious activity or linking it to another incident.

Connected operational systems are increasingly part of the environments MSPs are asked to secure, even when someone else remains responsible for operating the technology. The goal is not for MSPs to become experts in every physical system their customers use. It is to understand where those systems intersect with the networks they protect, who else shares responsibility for them, and how to keep a cybersecurity incident from becoming a physical and business loss.