Key takeaways
- On the night of 11 October, hackers remotely accessed internet-connected refrigeration controllers across more than 500 French supermarkets, raising freezer temperatures to 50°C and causing millions of euros in losses. The vulnerability they exploited had been publicly documented two months earlier and a patch had been issued.
- France is not an isolated incident. In under ten months across 2025, Marks & Spencer, United Natural Foods and Ahold Delhaize USA were all hit by significant cyberattacks affecting retail operations. The pattern points to an industry that has digitized its back-end infrastructure without matching security investment to protect it.
- The technical fix is known. What is harder to change is the organizational assumption behind the problem: that retail cybersecurity is an operational responsibility owned by whoever runs the store. As long as that assumption holds, the cost of being reactive will keep being paid.
The French supermarket hack of 11 October was, by the assessment of authorities and retailers alike, unprecedented; the first cyberattack to cause direct physical damage across an entire nation’s food supply chain. Hackers remotely accessed internet-connected refrigeration controllers at more than 500 supermarkets overnight, forced the units into a continuous defrost cycle, and raised temperatures inside freezers to 50°C. Fires broke out in some stores. By morning, Intermarché, Carrefour, Coopérative U, Monoprix and E.Leclerc had discarded millions of euros of food. The Paris Prosecutor’s Office confirmed a national criminal investigation by midday.
Most reporting has treated this as a dramatic cyberattack story. It is, however, also a retail story. A story about what happens when an industry connects its back-end operations to the internet at speed and leaves the security question for later. The cold chain is not the only system retailers have digitized without the infrastructure to protect it.
The specific vulnerability that enabled the attack had been publicly documented two months before it happened. Claroty, an operational technology security firm, presented the exact method at DEF CON in August by demonstrating how attackers could exploit a hidden authentication mechanism in Danfoss refrigeration controllers to take over them remotely. Danfoss issued a firmware patch. When the attack landed, an estimated 2,765 of the affected controllers were still exposed on the public internet, running software their operators had not updated. The retail cybersecurity problem here was known. The industry just hadn’t fixed it.
Why is retail so exposed?
Retail has spent a decade connecting its back-end operations to the internet — refrigeration, inventory management, payments, logistics, energy monitoring. Whether the security investment has kept pace is a question the industry is being forced to answer. France is the most acute consequence of that question going unaddressed, but it is not the first.
In April 2025, Marks & Spencer was hit by a ransomware attack that cost the company approximately £300 million after it was forced to suspend online orders. In June 2025, United Natural Foods — which supplies Whole Foods among others — took its systems offline after discovering a breach. That November, Ahold Delhaize USA confirmed a cyberattack that disrupted operations across more than 2,000 stores, including Food Lion, Hannaford and Stop & Shop. Three significant incidents across two continents in under ten months, each hitting a different layer of retail operations.
The pattern is consistent: retailers are running internet-connected systems at scale, often across hundreds or thousands of stores, managed by third-party vendors, and monitored with varying degrees of rigor. Every connected device is an entry point. Every unpatched system is an open door. The retail cybersecurity conversation has, until now, tended to focus on data — customer payment information, loyalty program records. The French supermarket hack makes a different point: that the exposure runs deeper than data, into the physical infrastructure that keeps stores functioning.
Is connectivity the problem?
The response from some retailers in the immediate aftermath pointed to the core tension. Coopérative U CEO Dominique Schelcher, while confirming the attack on his stores, defended connected refrigeration as operationally necessary — essential for monitoring temperatures remotely through the night and flagging anomalies without staff on-site. And he is right. Modern retail runs on this kind of connectivity. The real question is not whether to disconnect, but what security sits around these systems.
CERT-FR, France’s national cybersecurity response center, warned in the aftermath that a factory reset of affected systems is insufficient — that unpatched equipment left online “will certainly be compromised again.” Knowing about a vulnerability and having fixed it are not the same thing.
Claroty noted that artificial intelligence is reducing the time needed to scan systems for weaknesses, allowing attacks to be carried out at scale. The method for exploiting the Danfoss flaw was publicly demonstrated at DEF CON in August. The attack on French supermarkets came two months later. That gap — between a vulnerability becoming public knowledge and retailers acting on it — is where the real retail cybersecurity problem lies.
What happens next and what should retail do differently?
So, what does this supermarket hack mean for the future of connected operations in retail?
The honest answer is that it depends on what the industry chooses to learn from it. The technical fix is straightforward: patch the firmware, restrict public internet access to management systems, audit third-party vendors. CERT-FR has already issued the relevant guidance. What will be harder to change is the assumption that has allowed the problem to persist: that security is a technical responsibility sitting within an IT department or with a vendor, rather than an operational one that belongs to whoever is running the store.
The Mousquetaires Group, which had 300 stores compromised, told OCCRP the attack would take one to three weeks to fully restore. And that is the cost of a single incident, affecting a single retail group. Across an industry running the same connected infrastructure — refrigeration controllers, energy management systems, inventory platforms — across tens of thousands of stores globally, many managed by the same third-party vendors on the same unpatched software, the exposure is not a French problem. It is an industry-wide one.
Speaking to Al Jazeera on 13 October, cybersecurity analyst Steven Lachance was explicit: connected infrastructure live on the internet can be hacked, and without coordinated measures, attacks of this kind will keep happening. The French government has begun coordinating with its European counterparts, and that matters. But government coordination alone will not resolve what is fundamentally a business decision. The real cost of the France attack — the spoiled stock, the weeks of disrupted operations, the shoppers who arrived at stores to find empty shelves — is the cost of being reactive. As long as organizations treat retail cybersecurity as a compliance question rather than an operational priority, that cost will keep being paid. Both in money and, most damagingly, in consumer trust.
