Refrigeration systems at French supermarkets hacked, cyber incident disrupts distribution in the Netherlands

Cybersecurity engineer Kevin Tellier says outdated refrigeration equipment, exposed management systems can leave supermarkets vulnerable to attacks

Cyberattacks with direct physical consequences remain relatively rare, but expert Rafe Pilling warns that interconnected systems can magnify impact

Empty supermarket shelves usually suggest a shopping frenzy, panic buying ahead of a disaster or a disruption to deliveries. A cyberattack on refrigeration systems is a far less obvious explanation.

Yet that is what happened in France, where refrigerated shelves were left empty after hackers targeted systems used by several major supermarket chains.

During the attack, hackers remotely manipulated the systems, using their defrost function to raise temperatures to around 50C (122F), threatening fresh and frozen food stocks.

Systems from Danish manufacturer Danfoss, as well as those from US company Copeland and Italian company Dixell, were targeted.

Affected stores disconnected their equipment from the network, while the incident raised concerns over potential food losses and disruption to supermarket operations.

French Economy Minister Roland Lescure told parliament Tuesday that around 700 food distribution centers had been affected, while initial estimates put the number of targeted stores at around 500.

As France assessed the consequences of the attack, a separate incident was reported in the Netherlands.

Albert Heijn, the country's largest supermarket chain, announced Monday that operations at several distribution centers had come to a standstill after systems were shut down "preventively" following an attempted cyberattack.

While no link has been established between the two incidents, both highlight how cyberattacks can disrupt the infrastructure that supermarkets rely on to keep food fresh and supplies moving.

‘Attack on the French food supply chain’

Dominique Schelcher, head of French supermarket group Cooperative U, described the refrigeration attack as “unprecedented, extremely serious and unacceptable.”

Targeting equipment essential to preserving fresh products constituted “an attack on the French food supply chain,” he wrote on US social media platform X.

The incident has drawn attention from cybersecurity specialists because of its direct impact on physical operations.

"This is one of the first large-scale cyber-attack affecting directly the daily life of French people," Kevin Tellier, a cybersecurity engineer at French cybersecurity firm Synacktiv, told Anadolu.

Rafe Pilling, senior director of threat intelligence at cybersecurity company Sophos, said the French and Dutch incidents illustrated "two different but equally important" risks facing retailers.

The French attacks showed "how a cyber intrusion can have direct physical consequences, disrupting refrigeration and destroying stock," he said.

The Dutch incident, meanwhile, demonstrated "how a cybersecurity event can disrupt digital services and business operations."

"Together, they reinforce that cyber risk in retail is now a business continuity issue, not just an IT issue," Pilling said.

Could attacks become more disruptive?

Tellier said the French incident demonstrated how a cyberattack could disrupt everyday life, even without particularly sophisticated methods.

“A 15-year-old kid could have done this as it was not very sophisticated,” he said.

He also warned that artificial intelligence could increase attackers' capabilities, including those with limited experience.

“I don't really believe in rogue AI scenarios ... but rather in attackers using AI to augment their potential,” he noted.

Pilling said the French incident was not an outlier, although attacks with direct physical consequences were not the dominant form of cyber impact observed across Europe.

“Across Europe we're seeing increased legislative and regulatory attention to operational technology and other connected systems that were never originally designed to face today's threat landscape,” he said.

"Governments understand that this is a significant resilience issue both now and into the future," he added.

What made the French incident unusual was the visibility of its real-world consequences, Pilling said.

“Attacks that deliberately cross that cyber-physical threshold are relatively rare," he said.

Asked whether the incidents pointed to a deliberate strategy of targeting food security, Pilling said it was too early to draw such a conclusion.

“We do not yet know who was responsible or what their motive was,” he said.

Food supply chains and retail operations contribute to civilian resilience, meaning disruptions can have consequences beyond the companies directly affected, he added.

Operational technology: The overlooked vulnerability

One reason such attacks can have consequences beyond the digital world is their potential to compromise operational technology (OT), the hardware and software used to monitor and control physical processes, including refrigeration and industrial machinery.

"From my technical perspective, OT is often forgotten and has been largely underestimated during the last decades," Tellier said.

OT systems are designed to operate continuously, meaning updates and security measures are often seen as potential sources of disruption, he explained. The diversity of such equipment can also make security audits and improvements difficult.

Tellier said the attack did not surprise his company, which had previously reported vulnerabilities affecting Danfoss refrigeration systems and other brands.

“I remember well my colleagues logged on the control panel three years ago while they reported the vulnerability to Danfoss,” he added.

According to Tellier, Danfoss cooperated with Synacktiv and deployed a patch after three months. However, he said it remained unclear why the same vulnerability appeared again in 2025 and could have been exploited in France again this year.

Tellier said Danfoss had described the affected models as obsolete and no longer eligible for security updates, although some were still functioning properly.

Updating OT equipment can also be time-consuming, he said, because some systems require technicians to connect a USB stick to each device to install updates manually.

Tellier also pointed to management interfaces accessible through the internet, saying their exposure could have been identified through a security audit.

“Individual Supermarkets were not aware until today that they could lose money on a cyberattack,” he added.

Centralized systems, wider consequences

"Centralized management is useful to cut costs, it was implemented for this purpose. However, centralizing means introducing single points of failure that must be audited regularly," Tellier said.

Pilling said modern supermarkets rely on equipment vendors, maintenance providers, remote management platforms and connected equipment.

“Those dependencies improve efficiency, but they can also create shared points of failure if security isn't managed consistently across the ecosystem,” he said.

Centralized management software allows organizations to manage thousands of devices, but can also amplify the impact of an attack if a central platform is compromised, Pilling explained.

“The same technology that improves operational efficiency can rapidly magnify the impact of a security incident,” he said.

Food distribution systems could also be targeted to cause disruption without directly attacking traditional critical infrastructure, such as power or water networks, he added.

“A relatively small technical compromise can translate into spoiled stock, supply-chain disruption and public concern,” Pilling said.

The incident also demonstrated the potential consequences of attacks on widely deployed platforms and shared services, he said.

“The more interconnected these systems become, the greater the potential impact when something goes wrong,” he said.

New ‘cyber battlefield’

Preventing similar attacks will require supermarkets to look beyond software updates and strengthen the security of the systems that keep their operations running, according to Pilling.

“This is a resilience issue as much as a patching issue,” Pilling said.

He recommended that retailers identify their refrigeration systems, check whether they remain supported by manufacturers and secure their remote-access interfaces.

“Where remote access is operationally necessary, it should be limited to trusted management networks or secured remote-access services, with strong authentication and appropriate network segmentation,” he said.

Pilling also recommended updating supported equipment, isolating obsolete controllers and monitoring systems for unexpected changes.

"Regardless of who is ultimately responsible, the French refrigeration attack should be a wake-up call for retailers and operators of connected infrastructure," he said.

Systems supporting food supplies, safety and day-to-day services are now part of the "cyber battlefield" and need to be secured accordingly, he added. (AA)