Readers can now see how a single cyberattack on refrigeration control systems rippled across major supermarket chains in France, Belgium, and the Netherlands, taking cold storage, electronic shelf labels, and online ordering offline at the same time. The incident marks the first time attackers have turned industrial cooling networks against food retailers at this scale, and it raises practical questions about how exposed operational technology is to remote interference.
What happened to supermarket refrigeration in Europe
An ongoing cyberattack has disrupted refrigeration systems at several major European supermarket chains. Attackers reportedly forced affected units into a continuous defrosting cycle set to 50 degrees Celsius, a setting designed for short maintenance cycles, not for steady-state food storage. Sources described “a wave of heat” escaping from the fridges and freezers as the defrost functions ran without interruption.
The control systems involved were manufactured by Danfoss and used by French retailers, with three named chains affected in France alone. Early reports estimated losses around 300,000 euros, with the potential to reach several million euros nationwide once spoilage and missed sales are tallied.
Which retailers and countries were affected
In France, three retail chains using the compromised refrigeration controls reported disruption to store cooling. Separately, in the Netherlands, several supermarket chains were hit by a cybersecurity incident on Sunday afternoon, with websites taken offline and deliveries affected. Electronic shelf labels in those stores were also compromised, producing incorrect prices at the shelf edge.
One Dutch retailer confirmed it had taken preemptive measures to protect its IT environment, including temporarily shutting down parts of its systems while it assessed the situation. Its sister chain in Belgium, which belongs to the same group, also reported disruption. Loyalty programs in the affected stores were suspended, and in-store signage warned customers that prices could not be reliably displayed.
It remained unclear at the time of reporting whether the French and Dutch/Belgian incidents were a single coordinated campaign or two separate events sharing the same week.
Why supermarket refrigeration is now a target
Cold-chain control systems are a type of operational technology, meaning the hardware that runs physical processes like cooling, rather than the hardware that handles customer data. They are increasingly connected to the internet for legitimate reasons: remote temperature monitoring, automatic logging, and centralized alerts help operators catch a failing freezer before an entire pallet of meat spoils.
That same connection gives an attacker a way in. A controller that can be told to raise the temperature on purpose is, by definition, a controller that can be told to do something its operators did not request. The reported forced defrost at 50 degrees Celsius is the same setting a technician would use briefly during maintenance, turned into a continuous instruction that ruins the cold chain.
The damage from one compromised controller
A defrost cycle that does not stop is a spoilage incident that compounds hour by hour. Dairy, meat, and prepared foods have to be discarded once case temperatures rise above safe storage ranges, and regulators require documented cold-chain compliance. Beyond lost stock, stores also lose sales while shelves are empty, and the prices that do remain correct get questioned, because electronic shelf labels were also compromised in the Dutch and Belgian stores.
Reporting noted that the initial loss estimate sat near 300,000 euros but could rise into the millions as the full picture of damaged stock and missed revenue emerges.
What this means for food retailers and their suppliers
- Operational technology is now an attack surface, not a back-office system. Refrigeration, HVAC, and electronic shelf labels all carry network connections that must be treated as security-critical.
- An attacker who can read a control system can also write to it. Read-only monitoring is a real design choice, and it removes the most damaging capability, which is remote control.
- A defrost command that normally runs for two hours a day should not be configurable into a continuous run from outside the store’s own network. Hardening that path is a direct mitigation for this style of attack.
- Public-facing systems (websites, mobile apps, electronic shelf labels) and back-of-house systems (cold-chain controls) were disrupted at the same time in the Dutch/Belgian event, suggesting a shared entry point or shared identity infrastructure across them.
- Incident response now has to cover physical goods, not just data. Spoilage has a clock attached to it, and the response plan needs to include refrigeration technicians, not only IT.
What to do with this information
For any business that runs networked equipment in a physical process, the lesson is that operational technology needs the same threat modelling as servers and user accounts. Start with an inventory of which controllers are reachable from outside the store network, then decide for each one whether it needs that reach at all. For incident planners, the lesson is to assume that an attack on operations will look like a facilities problem first and only later be recognized as a security problem, which means cooling technicians and security teams need a shared call tree.
FAQ
What did the supermarket cyberattack in Europe actually do?
Attackers forced refrigeration units at affected stores into a continuous defrosting cycle at 50 degrees Celsius, a setting normally used for short maintenance. The same incidents also disrupted electronic shelf labels and online ordering in some stores.
Which countries and retailers were hit?
France, Belgium, and the Netherlands all reported disruption. In France, three retail chains using Danfoss refrigeration controls reported affected cooling facilities. In the Netherlands and Belgium, several chains reported website outages, electronic shelf-label failures, and suspended loyalty programs, with at least one group confirming it had shut down parts of its IT environment as a precaution.
Why is supermarket refrigeration a cybersecurity target?
Modern cold-chain controllers are connected to the internet for remote monitoring and alerts. That same connection lets an attacker send commands to the controller, including raising temperatures or forcing maintenance cycles. Treating operational technology as critical infrastructure, segmenting it from public networks, and limiting remote control to authorized roles are the standard mitigations.
This article summarizes reporting from tomshardware.com. See our editorial disclaimer for how our articles are produced.
Run a free scan to see your AI Visibility Score, SEO rating, and local citation accuracy.