700 French Supermarkets, Then 115 More Across Six Countries: What the Refrigeration Attacks Show About OT Exposure at Retail Scale
Original illustration created for Cyber Security Briefing.
700 French Supermarkets, Then 115 More Across Six Countries: What the Refrigeration Attacks Show About OT Exposure at Retail Scale
The French attack: 50°C and six-hour defrost cycles
New Food reported on October 14 that some Intermarché units held at 50°C for six hours, forcing the disposal of all fresh and frozen stock in those locations.
Les Mousquetaires, which operates Intermarché and Netto, told TIME that damage could run to several million euros. TIME reported on October 12 that investigators believe the temperature manipulation may have sparked fires at some sites, a claim the Paris prosecutor's cybercrime unit is investigating alongside reports of spoilage. France's national cybersecurity agency, ANSSI, is coordinating the response with European counterparts.
The vulnerability wasn't confined to one vendor. Infosecurity Magazine reported on October 14 that an advisory from CERT-FR named Danfoss AK-SC and AK-SM series alongside Dixell xweb as affected systems. Claroty CTO Amir Preminger told the outlet that many of these industrial control systems are deliberately exposed to the public internet "to reduce maintenance costs" — the same design choice, made independently by multiple vendors' customers, that let one campaign hit several controller brands at once.
A separate IT outage at Albert Heijn, with no confirmed link
Ahold Delhaize detected what it called malicious activity on October 12 — the same day the French refrigeration attack became public — and took websites and apps for Albert Heijn, Etos and Gall & Gall offline as a precaution, according to the company's own update published October 19. Those systems were restored by the 19th, with Albert Heijn home deliveries resuming on October 23 after a multi-day suspension.
CEO Frans Muller described the shutdown as a "precautionary measure that affected most of our brands across Europe and the United States," Reuters reported on October 19, when Ahold Delhaize also filed a formal police report in the Netherlands. The Dutch National Cyber Security Centre said at the time there was no confirmed direct link between the Ahold IT incident and the French refrigeration attacks. That caveat matters: the outage that froze Albert Heijn's ordering and delivery scheduling was an enterprise IT incident, not an OT compromise, and it still stopped physical replenishment at scale. Analysis published by Shieldworkz on October 13 made the same point about dependency — food retailers rely on enterprise applications that, taken offline for security reasons, halt the ability to restock stores and maintain cold-chain continuity, independent of whether a controller was ever touched.
The second wave reached six countries in one day
The Guardian reported on November 2 that a new round of attacks hit refrigeration systems in Sweden, Belgium and Luxembourg. Ahold Delhaize spokesperson Sarah De Meester confirmed to the Guardian that cooling-unit temperatures had risen in dozens of its Belgian and Luxembourg stores. Katrien Eggers of Belgium's Centre for Cybersecurity said the agency was aware of the incident but that perpetrators remained unknown — the only attribution either wave has produced as of November 2.
Bleeping Computer's count from the same day put the total above 115 stores, including 40 Delhaize locations, 15 Carrefour outlets in Belgium, and 13 SuperValu stores in Ireland; at least 17 Dutch butcher shops and neighborhood stores also reported refrigeration failures. The Record separately reported more than 50 affected stores in Belgium and more than a dozen each in Ireland, Estonia, the Netherlands and Luxembourg. Those are two independently reported tallies, not a reconciled total: Bleeping Computer's Belgian count and The Record's "more than 50" have not been cross-checked against each other, and it is not established that they describe the same set of stores. Mich Vergauwen, a Carrefour Belgium spokesperson, told Gulf News/AFP that a sudden temperature rise across 15 stores had no other explanation: "there is no other reason."
Sabcobel, a Belgian refrigeration specialist, told Helsinki Times that securing compromised equipment during the second wave sometimes required physically disconnecting units from the power grid — there was no way to lock an attacker out remotely once a controller was already compromised. Helsinki Times reported on November 2 that Finnish cybersecurity officials identified several dozen Danfoss controllers reachable from the public internet in Finland following the French incidents and have begun contacting owners directly to get them secured.
One detail from the November reporting is worth isolating. An Ikea store in Mons, Belgium, was also targeted, but a company spokesperson said it was the only Ikea location affected because it used a different service provider for refrigeration management than the controllers hit elsewhere. Vendor choice, in this case, was the thing that kept one site off the casualty list — not patching, not segmentation, but which third party ran the equipment.
What CISOs with OT-adjacent retail environments should take from this
The refrigeration controllers behind both waves were not obscure industrial equipment buried in a plant network. They were management interfaces for cooling units, reachable from the internet because that configuration is cheaper to maintain than a segmented alternative — a tradeoff made independently by multiple vendors' customers across multiple countries, which is how one campaign style hit several controller brands at once.
The Ikea Mons case is the clearest illustration of what that means in practice: a store avoided the November wave entirely because its refrigeration was managed by a different service provider than the one running the controllers hit elsewhere. That was a vendor contract, not a patch or a segmentation control the retailer had configured itself. An inventory exercise limited to a retailer's own network perimeter will miss controllers sitting on a refrigeration contractor's remote-management platform.
European Commissioner for Agriculture and Food Christophe Hansen said the French incident showed that "weaponisation of food has become a reality," according to New Food's October 14 report. What is established, three weeks and six more countries later, is the exposure pattern: internet-reachable refrigeration controllers, run by third-party vendors, outrunning remediation.
Links Verified at Time of Publish.
Sources
This article was reported from the following sources.
- Ahold Delhaize update on status of cybersecurity incident — Ahold Delhaize, 2026-10-19
- Supermarket freezers across Europe hit by second suspected cyber-attack — The Guardian, 2026-11-02
- Cyberattacks disrupt refrigeration systems at European supermarkets — PBS News / Associated Press, 2026-10-13
- Second wave of suspected cyberattacks hits supermarket freezers across Europe — The Record, 2026-11-02
- French Supermarket Cyber-Attack Impacts More Refrigeration Controllers — Infosecurity Magazine, 2026-10-14
- Cyberattack Targets French Supermarket Refrigerators, Forcing Mass Food Disposal — CNET, 2026-10-12
- Hackers disrupt refrigeration systems at European supermarkets — Bleeping Computer, 2026-11-02
- 'Unprecedented' Cyberattack Targets French Supermarket Fridges — TIME, 2026-10-12
- Cyberattack sends supermarket fridges to 50°C as 700 French stores hit — New Food, 2026-10-14
- Inside the Albert Heijn cyber incident: Investigating the attack, the IT/OT exposure, and the risks to critical operations — Shieldworkz, 2026-10-13
- Retailer Ahold Delhaize reports cybersecurity incident to Dutch police — Reuters, 2026-10-19
- New fridge cyberattack hits Belgium, Sweden stores — Gulf News / AFP, 2026-11-02
- Cyberattacks hit supermarket refrigeration systems across Europe — Helsinki Times, 2026-11-02
