French supermarkets hit by cyberattack on refrigeration systems

Hackers remotely manipulated refrigeration systems at hundreds of French supermarkets and distribution centers, raising temperatures to 50 degrees Celsius (122 degrees Fahrenheit) and threatening food supplies in what officials described as an unprecedented assault on the nation's retail infrastructure. French Economy Minister Roland Lescure told parliament on Tuesday that around 700 food distribution centers had been affected, while initial estimates indicated approximately 500 stores had been targeted.

Attack on French food supply chain

Dominique Schelcher, head of French supermarket group Cooperative U, described the incident as “unprecedented, extremely serious and unacceptable.” He stated that targeting equipment essential to preserving fresh products constituted “an attack on the French food supply chain,” according to his statement on social media platform X.

Kevin Tellier, a cybersecurity engineer at French firm Synacktiv, said the attack demonstrated how cyber intrusions can disrupt everyday life without requiring sophisticated methods. “This is one of the first large-scale cyber-attack affecting directly the daily life of French people,” Tellier told Anadolu, adding that “a 15-year-old kid could have done this as it was not very sophisticated.”

Operational technology risks

The incidents highlighted vulnerabilities in operational technology (OT) — the hardware and software controlling physical processes such as refrigeration and industrial machinery. “From my technical perspective, OT is often forgotten and has been largely underestimated during the last decades,” Tellier said, noting that such systems are designed for continuous operation, making security updates difficult to implement.

Tellier explained that some refrigeration systems require technicians to connect USB sticks manually to each device for updates, while centralized management platforms create single points of failure. “Centralized management is useful to cut costs, it was implemented for this purpose. However, centralizing means introducing single points of failure that must be audited regularly,” he said, adding that Danish manufacturer Danfoss had previously patched similar vulnerabilities reported by Synacktiv three years ago.

Business continuity concerns

Rafe Pilling, senior director of threat intelligence at cybersecurity company Sophos, said the French and Dutch incidents illustrated “two different but equally important” risks facing retailers. “Together, they reinforce that cyber risk in retail is now a business continuity issue, not just an IT issue,” Pilling said, noting that attacks crossing the cyber-physical threshold remain relatively rare but demonstrate how “a relatively small technical compromise can translate into spoiled stock, supply-chain disruption and public concern.”

Albert Heijn, the Netherlands' largest supermarket chain, announced on Monday that it had preventively shut down systems at several distribution centers following an attempted cyberattack, though no link has been established between the two incidents. Systems from manufacturers including Danfoss, Copeland and Dixell were targeted during the French attacks, which saw hackers exploit remote defrost functions to destroy fresh and frozen food stocks.

Pilling recommended that retailers identify their refrigeration systems, verify manufacturer support status and secure remote-access interfaces with strong authentication and network segmentation. “Regardless of who is ultimately responsible, the French refrigeration attack should be a wake-up call for retailers and operators of connected infrastructure,” he said, adding that systems supporting food supplies are now part of the “cyber battlefield.”