A cyberattack halts a French food, health or transport service for a day or more
The test Between 26 Oct 2026 and 25 Oct 2027, a cyberattack, stated as such by the operator or a French authority, closes or diverts a French hospital's emergency department or cancels its planned operations for 24 hours or more, suspends a French rail, air, urban transport or port operator's service across a region or a hub for 24 hours or more, or forces 100 or more French food stores to withdraw their chilled or frozen goods.
Not under way · Confidence: medium · Reviewed 25 Oct 2026 · Scores from 1 to 10
This page answers: What could happen, how it is scored, and who is exposed?
Using this page
- Read the two scores: Likelihood and Impact are kept apart.
- Check what is happening, each fact with its source.
- Use the calendar for the dates to watch.
Follow this riskSign in to follow; one weekly email if you ask for it.
Likelihood ↑ 12 Oct 2026: CERT-FR alert CERTFR-2026-ALE-012 on numerous compromises of supermarket refrigeration controllers, campaigns probably still under way.
Impact is the average of the four parts, rounded, plus one point when Canada is directly hit on two or more channels, up to 10.
Two separate scales from 1 to 10. Strature never multiplies or merges them.
What changed
Dated, newest first
- Likelihood 7 to 6.
- DGFiP suffered a serious cyberattack in summer 2026; ministers met ANSSI on 19 Oct [8]
- CERT-FR alert ALE-012: numerous compromises of Copeland xweb, Dixell xweb, Danfoss AK-SC and AK-SM controllers; campaigns probably still under way [1]
- At least 350 supermarkets; at least 4,500 Danfoss interfaces visible online; many affected units at end of life; no ransom demand or claim [4]
- Second night 12-13 Oct on Dixell systems; freezers set to 150C; fires; 500-700 stores reported; EUR100,000-200,000 lost by some stores; OFAC with ANSSI [5]
- Coopérative U 80 of 2,000 stores, Carrefour 80, Monoprix about 30; Les Mousquetaires expects losses of tens of millions of euros; Spain, Portugal, Poland, Germany and Belgium also affected (Sekoia) [3]
- About 150 Intermarché stores had fridges raised to 50C for six hours; affected food thrown out; Paris prosecutor inquiry [2]
Why it matters
On the night of 11-12 Oct 2026 attackers took over the refrigeration controllers of hundreds of French supermarkets and heated fridges to 50C; on a second night some freezers were set to 150C. France's cyber agency warned that the campaigns are probably still going on. Attacks that stop hospital care are not new: 30 French health establishments were hit and encrypted by ransomware in 2022 and 2023.
Why Likelihood 6 Pushes: campaigns still under way, 4,500 exposed interfaces, end-of-life devices; for other limbs, 30 health establishments encrypted in 2022-2023 and the summer 2026 attack on the tax administration. Brakes: the alert and its simple fixes, the inquiry, the state's cyber roadmap, no new store wave found after 13 Oct.
Why Impact 3 Threshold case: a regional transport service stopped for a day.
The other facts on file (3)
- Armentières hospital: ransomware on 10-11 Feb 2024 encrypted more than 100 servers and workstations; emergency department closed (length not given) [6] (27 Feb 2024)
- 30 French health establishments compromised and encrypted by ransomware in 2022 and 2023 (ANSSI report CERTFR-2024-CTI-010, as reported) [7] (7 Nov 2024)
- ANSSI threat report on the health sector, Jan 2022 to Dec 2023 [10] (7 Nov 2024)
Where it sits
How it spreads
Between 26 Oct 2026 and 25 Oct 2027, a cyberattack, stated as such by the operator or a French authority, closes or diverts a French hospital's emergency department or cancels its planned operations for 24 hours or more, suspends a French rail, air, urban transport or port operator's service across a region or a hub for 24 hours or more, or forces 100 or more French food stores to withdraw their chilled or frozen goods.
Not under wayChannels 5 on the card
- CanadaNo direct Canadian loss sourced.
- Food supplyStores and distribution centres hold about six days of stock (Netherlands) [4]; a wider attack would empty shelves of fresh and frozen food.
- Health careA closed emergency department sends patients to other hospitals, as at Armentières [6].
- SafetyOverheated refrigeration units started fires in some stores [5].
- Rules and costsOperators must take controllers off the internet and replace end-of-life units [1][4].
Three scenarios and their signposts
- S1
Patched
Operators take controllers offline and no service stops for a day.
- S2
A hospital again
Ransomware closes an emergency department or cancels operations for a day or more.
- S3
Transport hit
An attack suspends a rail or airport service for a day.
| Path | Signpost |
|---|---|
| S1 | CERT-FR closes alert ALE-012 |
| S2 | A regional health agency notice of a hospital in degraded mode |
| S3 | A CERT-FR alert naming transport systems |
No probability is given for the three paths.
Dates to watch
The dates to watch
A dot is a day, a bar a month or a year; a hollow mark is tentative. The line marks today.
- 18 Apr 2027 Presidential election, first round [9] Declared · Outside event
- 2 May 2027 Presidential election, second round [9] Declared · Outside event
Sign in, with alerts on, for an email 7 days and 1 day before.
The other side
The alert gives every French grocer a clear checklist: take controllers off the internet, replace end-of-life units, use secure remote access [1]. Operators across the EU face more spending on operational-technology security (Strature's view; not sized).
Connected in Strature
- France
- Belgium
- Spain
- Portugal
- Poland
- Germany
- Ransomware halts a major port, hospital network or pipeline for three days or more Shares a channel: Hospital ransomware is a limb of both; that card needs three hospitals for three days.
- A state-linked cyber attack cuts power, water or a port for a day or more Shares a channel: Attacks on operational controllers; that card needs a state attribution and a power, water or port cut.
Sources
10 sources, numbered as the text cites them
- Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (CERTFR-2026-ALE-012). CERT-FR (ANSSI) · 16 Oct 2026 · Official · confidence high · retrieved 26 Oct 2026
- France : des réfrigérateurs de centaines de supermarchés déréglés par une cyberattaque (Reuters). Boursorama · 12 Oct 2026 · News · confidence high · retrieved 26 Oct 2026
- Attackers heat French supermarket fridges. The Hacker News · 13 Oct 2026 · News · confidence medium · retrieved 26 Oct 2026
- Inquiétude face à la série de cyberattaques contre des supermarchés en France et en Belgique. Euronews · 14 Oct 2026 · News · confidence medium · retrieved 26 Oct 2026
- Cyberattaque des supermarchés : la vague se poursuit en France et s'étend en Europe. Sud Radio · 14 Oct 2026 · News · confidence medium · retrieved 26 Oct 2026
- Piratage de l'hôpital d'Armentières : près d'1 million de données patients publiées. Le Monde Informatique · 27 Feb 2024 · News · confidence medium · retrieved 26 Oct 2026
- Trente hôpitaux français ont été visés par des cyberattaques en deux ans. Le Quotidien du Médecin · 7 Nov 2024 · News · confidence medium · retrieved 26 Oct 2026
- Budget 2027, fonction publique, cybersécurité. Acteurs Publics · 20 Oct 2026 · News · confidence medium · retrieved 26 Oct 2026
- Toasted, not burnt: France's bond sell-off and the road to the 2027 election. Allianz Trade · 9 Oct 2026 · Industry · confidence high · retrieved 26 Oct 2026
- Secteur de la santé - État de la menace informatique (CERTFR-2024-CTI-010). CERT-FR (ANSSI) · 7 Nov 2024 · Official · confidence high · retrieved 26 Oct 2026
Reviewed 25 Oct 2026 · version 1 · last change: reviewed · All risks