European supermarket chains lost control of refrigeration and pricing systems on Sunday and Monday after a cyberattack hit cold-chain controllers used across France, Belgium, and the Netherlands. French retailers confirm that hackers forced Danfoss-made refrigeration units into continuous defrosting at 50 degrees Celsius, knocking out temperature control, disrupting deliveries and breaking electronic shelf labels that drive in-store prices.<\/p>\n
Early reports put losses at roughly 300,000 euros and warn the nationwide total could climb into the millions. Retailers have taken affected systems offline, pulled websites for maintenance and warned customers that loyalty programs and online ordering are unreliable until service returns.<\/p>\n
French chains Intermarch\u00e9, Leclerc and Coop\u00e9rative U were all hit through the shared refrigeration control platform. In the Netherlands, several supermarket chains saw their websites taken down, deliveries interrupted and electronic shelf labels compromised, with Belgium’s Delhaize chain reporting disruption as well.<\/p>\n
Coop\u00e9rative U confirmed publicly that “a cyberattack has been affecting the refrigeration production facilities of several stores in our network since last night,” adding that teams were mobilised alongside refrigeration engineers to restore service and that an investigation would be opened. The company described the incident as “extremely serious,” noting that targeting equipment essential to fresh-food storage and to feeding the French population is unacceptable.<\/p>\n
Attackers reached the controllers that manage supermarket cold rooms and freezer cabinets, then pushed them into a forced defrost cycle at 50 degrees Celsius. Under normal operation, the automatic defrost function runs for about two hours a day to clear ice from evaporator coils; here it was turned into a continuous cycle that warms the cabinets, not cools them. Staff at affected stores described a wave of heat escaping from fridges and freezers.<\/p>\n
At the same time, the electronic shelf labels that supermarkets use to display prices and promotions stopped reflecting real prices, so checkouts either could not scan or risked charging the wrong amount. Many stores suspended loyalty programs and warned customers in person about pricing problems, as visible in images shared from Amsterdam.<\/p>\n
Reports point to two parallel incidents that authorities have not yet linked. The French cluster centres on refrigeration controllers at multiple banners; the Dutch and Belgian cluster centres on IT systems, websites and electronic shelf labels. Both went live within hours of each other, which is why traders are watching closely to see whether one campaign hit two countries or two separate campaigns struck at once.<\/p>\n
The same remote access that lets a head office check temperatures overnight is what lets an attacker push the setpoint to 50 degrees Celsius from a continent away. Centralised monitoring and control reduce food spoilage, cut energy use and make compliance audits simpler, but they also turn every cold room into a node on a corporate network. The trade-off has now produced a direct hit on the fresh-food supply.<\/p>\n
Research on cyber resilience in critical French infrastructure reaches a similar conclusion from a different angle. A 2025 study in the Journal of Emergency Management documented a simulated ransomware exercise run by Assistance Publique-H\u00f4pitaux de Paris in July 2023, with more than 200 participants over 24 hours. The simulation found that technical countermeasures worked, but communication failures between departments, conflicting priorities across clinical, managerial and administrative roles, and information overload pushed senior managers into a reactive mode where they could not plan ahead. The authors urged hospitals and other operators of essential services worldwide to adopt the same multidisciplinary approach to limit the damage of cyberattacks, which they predicted would become more frequent.<\/p>\n
A separate 2022 paper in Expert Systems Applications looked at how attackers exploit trusted brand names during crises and showed that a small number of carefully extracted features from domain names can be used to flag malicious sites reliably, pointing to fast, automated detection as one practical defence.<\/p>\n
Operators of cold-chain infrastructure now have a working example of what a worst-case attack looks like on a shared control platform. Expect three concrete shifts: tighter segmentation between refrigeration controllers and the rest of the IT estate, manual fallbacks for pricing on electronic shelf labels, and clearer external communication templates so customers hear about outages from the retailer rather than from social media. None of this removes the upside of remote monitoring, but it raises the cost of an attacker reaching the setpoint in the first place.<\/p>\n
French chains Intermarch\u00e9, Leclerc and Coop\u00e9rative U reported disruption through shared Danfoss refrigeration controllers. In the Netherlands, several supermarket chains had their websites taken down and electronic shelf labels compromised, and Belgium’s Delhaize chain also reported disruption.<\/p>\n
Attackers reached the refrigeration control platform and forced the automatic defrost function, which normally runs for about two hours a day, into a continuous cycle at 50 degrees Celsius. Staff described a wave of heat escaping from fridges and freezers, with system losses already near 300,000 euros.<\/p>\n
It is unclear. The French incidents targeted refrigeration controllers, while the Dutch and Belgian incidents focused on IT systems, websites and electronic shelf labels. Investigators have not yet determined whether the same actors were responsible for both.<\/p>\n