Cyberattacks aren’t just stealing your passwords; they’re spoiling your food.

The Paris prosecutor’s office opened an investigation on Monday into an overnight cyberattack on refrigeration systems at hundreds of French supermarkets. Hackers raised the temperature of refrigerators and freezers, sparking fires and causing food to spoil.

In a statement to TIME, French retailer Les Mousquetaires, which runs supermarket chains Intermarche and Netto, said damage from the attack could amount to several million euros in losses.

“Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented,” Dominique Schelcher, CEO of French supermarket chain Cooperative U, posted on X.

France’s National Cybersecurity Agency (ANSSI) confirmed to TIME that it is investigating the attack “both at the national level, to accompany potential victims, and at the European level to coordinate with its counterparts.” 

The incident has raised concerns about the threat of cyberattacks on food security as food supply chains increasingly rely on network-connected systems.

Christophe Hansen, the European Union’s food and agriculture commissioner, condemned the attack, noting in a post on X: “Food security requires more attention at all levels, because the exploitation of food has become a reality.”

Read More: FBI Probes Possible Dark Web Sale of Over 153 Million Driver’s License Scans. How Can You Protect Your Info?

Hackers target connected refrigerators, spoiling food across hundreds of stores

BFM-TV, which first reported the attack, said hackers “managed to remotely trigger the forced defrosting of the refrigeration systems in numerous stores.” The French broadcaster said the cyberattack involved forcing a continuous defrost cycle, setting temperatures to 50°C (122°F). French newspaper Le Monde reported that hackers also extended the defrost cycle in some freezers and cold-storage rooms from one hour to eight hours to delay alarms.

Supermarkets typically use central control panels to manage multiple refrigeration units. Many of these control panels are connected to the internet to allow maintenance companies to remotely access them. But the French government said Monday that exposing a management interface to the internet is “contrary to best practices,” and that remote administration should be restricted to trusted IP addresses if it is necessary.

Monday’s attack affected two refrigeration management product series by Danish company Danfoss, AK-SC and AK-SM, according to an ANSSI alert.

Danfoss told news outlets that it was “aware of incidents in France affecting a limited number of refrigeration management systems.” The company said the affected units “were running outdated firmware” and that it “long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions.”

Investigators have yet to publicly identify how attackers gained access to the Danfoss systems.

Around 180 Intermarche or its Netto brand supermarkets were targeted, parent company Les Mousquetaires told TIME, although BFM-TV reported a higher count of 300. At least 100 Cooperative U stores, 80 Carrefour outlets, 30 Monoprix stores and several E.Leclerc outlets were also affected, the retailers said. Independent grocery stores and butchers that use the same refrigeration system may also have been affected.

Intermarche CEO Thierry Cotillard told BFM-TV that the “unprecedented” attack resulted in losses amounting to “tens ​of millions of euros nationwide in a single day.”

Two supermarkets in Alsace, Intermarche and Super U, reported losses of 270,000 euros, according to BFM-TV. An Intermarche in La Haye, Normandy, posted on Facebook that temperatures reached 80°C (176°F), causing some equipment to melt. Supermarket owners described throwing out nearly a dumpster’s worth of frozen food.

TIME has reached out to Danfoss and major French retailers for comment.

Growing cyber threat to food and agriculture

France’s ANSSI told TIME that it is coordinating with European counterparts given that stores in other countries may also use the same software and be at risk. Reuters reported, citing a cyber threat intelligence analyst, that Spain, Portugal, Poland, Germany, and Belgium were affected. Internet scans found Danfoss refrigeration controllers exposed in South Africa, the U.S., the U.K., and other countries. France had the largest observed concentration, holding nearly 60% of the world’s exposed Danfoss controllers detected by scans, according to cyber intelligence firm U.K. Cyber Defence.

No other countries have confirmed related breaches so far.

The attack is also not the first time cyber incidents have disrupted food systems.

In late August, at least six U.S. military commissaries reported refrigeration outages, resulting in spoiled chilled and frozen products. Military investigators are investigating the outages, but have not commented on the nature of the investigation.

In June 2025, U.S. food distributor United Natural Foods also temporarily took certain systems offline during a suspected breach, which impacted order fulfillment and distribution.

Also on Monday, Dutch retailer Ahold Delhaize took several systems offline as a precautionary measure amid “a security issue within its network.” The retailer operates the Netherlands’ biggest supermarket chain Albert Heijn, as well as several U.S. grocery brands, including Stop & Shop, Hannaford, and Food Lion. In a Monday statement, Dutch retail brands Albert Heijn, Etos, and Gall & Gall said they were dealing with a cybersecurity incident. There is no established link between these incidents and the French cyberattack.

Food systems are becoming increasingly exposed to cyberattacks as farms, processors, distributors, and supermarkets rely on network-connected equipment throughout their supply chains, analysts have warned. The Food and Ag-ISAC, a nonprofit industry group based in Washington, D.C., tracked 227 ransomware incidents in the food and agriculture sector from January through July, up 62% from the same period last year.

The European Union’s cybersecurity agency ENISA also noted that food production, processing and distribution were among the sectors most affected by ransomware claims in its latest E.U. threat assessment.

Prior to Monday’s attack in France, cybersecurity firm Claroty published an August report that showed how flaws in Danfoss’s AK-SM 800A controller could allow an intruder to bypass a login and gain control of software used to control supermarket refrigeration. Danfoss’s firmware updates included fixes for those flaws.