OMM Newsroom
Empty supermarket shelves can be caused by panic buying or delivery problems, but in France they were left bare after hackers targeted refrigeration systems used by several major supermarket chains.
The attackers remotely manipulated the systems’ defrost function, raising temperatures to around 50C (122F) and putting fresh and frozen food stocks at risk, Anadolu reported. Equipment from Danish manufacturer “Danfoss”, US company “Copeland” and Italian company “Dixell” was targeted.
Affected stores disconnected the equipment from their networks. French Economy Minister Roland Lescure told parliament on Tuesday that around 700 food distribution centers had been affected; initial estimates put the number of targeted stores at about 500.
Separately, Dutch supermarket chain “Albert Heijn” said on Monday that operations at several distribution centers had stopped after systems were shut down “preventively” following an attempted cyberattack. No link has been established between the two incidents.
Dominique Schelcher, head of French supermarket group Cooperative U, called the refrigeration attack “unprecedented, extremely serious and unacceptable”. He wrote on the social media platform “X” that targeting equipment needed to preserve fresh products amounted to “an attack on the French food supply chain”.
Kevin Tellier, a cybersecurity engineer at French firm “Synacktiv”, said the attack was among the first large-scale cyber incidents to directly affect everyday life in France. Rafe Pilling, senior director of threat intelligence at “Sophos”, said the French case showed how an intrusion could disrupt refrigeration and destroy stock, while the Dutch incident demonstrated how a cyber event could interrupt digital services and business operations.
“Together, they reinforce that cyber risk in retail is now a business continuity issue, not just an IT issue,” Pilling said.
Outdated equipment and exposed systems increase risks
Tellier said the French attack did not require particularly sophisticated methods. He also warned that artificial intelligence could enhance attackers’ capabilities, including those with limited experience.
Pilling said incidents with direct physical consequences remained relatively rare, but European governments were paying increased attention to operational technology and connected systems that were not designed for today’s threat landscape. He said it was too early to conclude that the attacks reflected a deliberate strategy targeting food security, as the perpetrators and their motives were not known.
Operational technology, or OT, includes the hardware and software used to monitor and control physical processes such as refrigeration and industrial machinery. Tellier said these systems were often overlooked, while the need for continuous operation could make updates and security measures difficult to implement.
Tellier said “Danfoss” had previously cooperated with “Synacktiv” after the company reported vulnerabilities in refrigeration systems, and had deployed a patch after three months. He said it remained unclear why the same vulnerability appeared again in 2025 and could have been exploited in France again this year. “Danfoss” had described the affected models as obsolete and no longer eligible for security updates, he said, although some remained operational.
Some updates require technicians to connect a USB stick to each device and install them manually, Tellier said. He also warned that internet-accessible management interfaces could be identified through security audits.
Centralized systems can magnify disruption
Centralized management can reduce costs, Tellier said, but also creates single points of failure that require regular audits. Pilling said retailers depend on equipment suppliers, maintenance providers, remote management platforms and connected devices; if security is not managed consistently, those dependencies can create shared vulnerabilities.
Centralized software can help organizations manage thousands of devices, but a compromise of the central platform may also increase the scale of an attack. Pilling said a relatively small technical breach could lead to spoiled stock, supply-chain disruption and public concern.
He recommended that retailers identify their refrigeration systems, check whether manufacturers still support them and secure remote-access interfaces. Where remote access is necessary, he said, it should be restricted to trusted management networks or secured services, with strong authentication and appropriate network segmentation.
Pilling also advised updating supported equipment, isolating obsolete controllers and monitoring systems for unexpected changes. He said the French attack should serve as a warning to retailers and operators of connected infrastructure, adding that systems supporting food supplies and day-to-day services were now part of the “cyber battlefield”.
