Hackers hit supermarket refrigeration

What's happened

Large-scale cyberattacks have targeted internet-connected refrigeration systems at dozens of French supermarkets and affected some Dutch stores, forcing temperatures to surge to as high as 50°C, spoiling fresh and frozen food, triggering fires and prompting mass disposal. French authorities have opened a probe and ANSSI is leading the investigation while retailers report tens of millions of euros in losses.

What's behind the headline?

What happened and why it matters

Hackers have remotely altered refrigeration controls across multiple supermarket chains, forcing forced-defrost cycles and heating units to temperatures reported up to 50°C. This has destroyed fresh and frozen stock, caused fires in some stores and halted delivery services where online systems were taken offline.

Who is exposed

• Legacy industrial controllers and refrigeration managers that are accessible over the internet are the primary vector. Reports say affected units were running outdated firmware and a Danfoss-supplied controller has been singled out by investigators.
• Large national chains with centralized remote management are particularly vulnerable because a single compromise can scale to hundreds of sites.

Immediate consequences

• Retailers have thrown away affected stock, with Intermarché reporting "tens of millions of euros" in single-day losses and dozens of stores discarding all fresh and frozen goods.
• Operational disruption has hit online ordering and deliveries for some retailers, notably Ahold Delhaize in the Netherlands, which took systems offline as a precaution.

Likely next steps and impacts

• Regulators and prosecutors will prioritise technical forensics to determine whether attackers exploited known Danfoss vulnerabilities or weak credentials on legacy devices. ANSSI will coordinate with European counterparts.
• Retailers will accelerate firmware updates, isolate control networks from corporate networks and force maintenance providers to adopt VPNs or protected networks for remote access.
• Insurance disputes will surface: some policies may not explicitly cover this form of in-store cyber-physical sabotage, which will push firms to seek policy clarification and to harden coverage conditions.

Forecast

• This will force faster retirement of legacy controllers and push retailers to invest in segmented networks, endpoint monitoring and offline failsafes for temperature alarms. Policymakers will push for minimum cyber-hygiene standards for critical supply-chain equipment.

Bottom line

The attack moves digital risk from abstract data theft into physical, everyday harm: consumers lose food, retailers lose revenue, and supply-chain resilience will become a regulatory and commercial priority.

How we got here

Supermarket cold aisles are run by internet-connected control panels that let maintenance teams adjust systems remotely. Investigators and retailers have said many affected units ran outdated firmware and ANSSI has identified a vulnerability in software supplied by Danfoss.

Our analysis

AP News reported that attackers remotely took control of refrigeration systems in hundreds of supermarkets across France and that temperatures reached 50°C for about six hours, forcing mass disposal and prompting the agency to urge secure VPN connections and firmware updates (AP, 14 Oct). Al Jazeera and France 24 quoted retailers' figures: Intermarché said some 150 stores were hit and Coopérative U said almost 100 outlets were affected; both described the attack as "unprecedented" and warned of nationwide losses running into "tens of millions of euros" (Al Jazeera, 13 Oct; France 24, 12 Oct). CNBC cited Sekoia analysts saying the problem had affected several European countries and quoted Cooperative U CEO Dominique Schelcher calling the attack "extremely serious" and unacceptable (CNBC, 13 Oct). The Guardian, BBC and Politico noted that Paris prosecutors have opened a probe and that Prime Minister Sébastien Lecornu has asked ANSSI to investigate; several outlets reported ANSSI has identified a vulnerability in software supplied by Danfoss and that many affected units ran outdated firmware (The Guardian, BBC, Politico, 12–13 Oct). The sources converge on the technical vector (internet-connected controllers and outdated firmware) and on the scale of retail losses; they differ slightly on the extent of cross-border impact, with AP and CNBC reporting incidents in the Netherlands and other countries while the Dutch cybersecurity centre said it saw "no reason at this time" to link incidents across Europe (AP; Dutch National Cybersecurity Center via AP).

Go deeper

• Which supermarket chains and how many stores are confirmed affected in each country?
• What specific Danfoss products and firmware versions are vulnerable and how can stores patch them?
• Will insurers cover these losses or will retailers face uninsured costs?

More on these topics

• France - Country in Europe

  France, officially the French Republic, is a country consisting of metropolitan France in Western Europe and several overseas regions and territories.

• Paris - Capital of France

  Paris is the capital and most populous city of France, with an estimated population of 2,150,271 residents as of 2020, in an area of 105 square kilometres.

• Monoprix - Retail chain company

  Monoprix S.A. is a major French retail chain with its headquarters in Clichy, Hauts-de-Seine, France, near Paris. The company's stores combine food retailing with fashion, beauty and home products.

• Carrefour - French hypermarket brand of the Carrefour Group

  Carrefour Group, S.A. (French: Groupe Carrefour, [kaʁfuʁ] ), is a French multinational retail and wholesaling corporation headquartered in Massy, France. It operates a chain of hypermarkets, grocery stores and convenience stores. By 2024, the group had 14,000 stores in 40 countries. It is the seventh-largest retailer in the world by revenue.

• Danfoss - Company

  Danfoss is a Danish multinational company, based in Denmark, with more than 28,000 employees globally. Danfoss was founded in 1933 by engineer Mads Clausen.

• Emmanuel Macron - President of France

  Emmanuel Jean-Michel Frédéric Macron is a French politician who has been President of France and ex officio Co-Prince of Andorra since 14 May 2017.

• Reuters - News organization company

  Reuters is an international news organization owned by Thomson Reuters. It employs some 2,500 journalists and 600 photojournalists in about 200 locations worldwide. The agency was established in London in 1851 by the German-born Paul Reuter.

• Agence France-Presse - Press company

  Agence France-Presse is an international news agency headquartered in Paris, France. Founded in 1835 as Havas, it is the world's oldest news agency.

• Russia - Country

  Russia, or the Russian Federation, is a transcontinental country located in Eastern Europe and Northern Asia. Covering an area of 17,125,200 square kilometres, it is the largest country in the world by area, spanning more than one-eighth of the Earth's in

• Belgium - Country in Europe

  Belgium, officially the Kingdom of Belgium, is a country in Western Europe. It is bordered by the Netherlands to the north, Germany to the east, Luxembourg to the southeast, France to the southwest, and the North Sea to the northwest.

• Ahold Delhaize - Retail company

  Koninklijke Ahold Delhaize N.V., commonly known as Ahold Delhaize, is a Dutch grocery retail company. Its business format includes supermarkets, convenience stores, hypermarkets, online grocery, online non-food, drugstores, and liquor stores.

• Albert Heijn - Supermarket company

  Albert Heijn is the largest supermarket chain in the Netherlands with a market share of 34.8% in 2020. It was founded in 1887 and is part of Ahold Delhaize since 2016.