Why attacks on the physical side of food retail are growing, with lessons from the refrigeration attacks of October and November.
Overnight, supermarket freezers in six European countries were switched remotely into defrost and left to climb to 50°C. It is the second time in three weeks. In October it was around 700 stores in France, with a second wave followed overnight on 1-2 November. It hit stores in Belgium, Luxembourg, Sweden, the Netherlands, Estonia, Finland and Ireland, and further incidents were reported in Portugal, Italy and the UK.
No group has claimed responsibility for the attacks, and no government has publicly identified those responsible. But whoever is behind them, these incidents point to a much bigger issue. Cyberattacks are no longer just about stolen data or compromised systems. They can bring physical operations to a halt, damage or spoil stock, and seriously disrupt business continuity.
For the past decade, retail cybersecurity has largely focused on protecting payment data, websites and customer loyalty accounts. But the attacks causing the greatest disruption are increasingly targeting the operational side of the business, from cold storage and warehouses to the shop floor. It's a shift that many retailers are still not adequately prepared to defend against.
A word on the facts. The 2 November incident is still unfolding, and the figures here are what had been reported by early afternoon. Nobody has claimed either of the refrigeration attacks and no government has said who was behind them. Where reports disagree, I say so.
1. How we got here
2. France, 11 October: the first mass OT attack on food retail
Overnight on 11 October, someone took control of refrigeration controllers in supermarkets across France and put them into defrost with the food still inside. The Paris prosecutor’s office puts the number of victims at about 700. The chain-by-chain numbers depend on who you read. AFP said at least 300 Intermarché and Netto stores; Reuters said about 150. Coopérative U reported 80 of its 2,000 stores, Carrefour 80, Monoprix around 30, and several E.Leclerc stores were hit too.
No alarms went off, and most of the stores were empty for the night. After about six hours many cabinets were at 50°C. One store in Normandy recorded 80°C. Some units melted or caught fire, and the sprinklers then did their own damage. Whole aisles of chilled and frozen food had to be thrown away. A single Intermarché in Issy-les-Moulineaux binned several tonnes, and two stores in Alsace put their combined loss at €270,000. Estimates for the whole event run into tens of millions of euros. The Prime Minister, Sébastien Lecornu, asked ANSSI to investigate and to work with other European countries, and CERT-FR issued an alert (CERTFR-2026-ALE-012) the next day.
Attention quickly turned to Danfoss controllers. Two of the models involved, the AK-SC 355 and AK-SM 800, went out of support in 2016 and 2021 and haven’t had a security update since. Newer AK-SM 800A units on old firmware were also affected, as were some Copeland and Dixell XWEB controllers. CERT-FR hasn’t confirmed exactly how the attackers got in. What nobody disputes is that these controllers could be reached from the internet. Baptiste Robert of Predicta Lab counted 2,752 exposed Danfoss systems, 1,590 of them in France, and the researcher Kevin Beaumont reported several thousand.
3. Europe, 2 November: the second wave
This one started at around midnight on Sunday. Retailers say their freezers were set to 50°C using the same built-in defrost mode, with the usual time and temperature limits overridden. Belgium has been hit hardest, with more than 50 stores reported so far, among them Delhaize, Carrefour and Spar. In Sweden a smaller number of ICA and Coop stores are affected, and Ireland, Estonia, the Netherlands and Luxembourg have more than a dozen between them. An Estonian contractor says an older Danfoss system was accessed. The Dutch broadcaster NOS reports that Copeland equipment was targeted in Belgium.
The comment that stopped me came from Stephan Moelans, Chief Executive of the Belgian refrigeration installer Sabcobel. He says about 20 of the units his company looks after need physical work, not a software update. The stopgap is to move them onto a secured connection, which most of his customers had already done after France. Three weeks’ notice was never going to be enough, because the real fix is new hardware. Danfoss and Copeland both say the affected kit is mostly discontinued, and Danfoss has a hard end-of-service policy. The EU Cyber Resilience Act won’t put tougher obligations on manufacturers until December 2027. Until then, nobody is legally required to fix any of this.
4. How the attack works
5. Why store OT is such an easy target
Someone else runs it. French supermarkets commonly hand refrigeration to specialist contractors, who put the controllers online so they can monitor them remotely. Often the retailer’s security team doesn’t know the devices are there, never mind what firmware they run.
It outlives its support. A refrigeration plant can run for fifteen years or more. Controllers that lost support in 2016 and 2021 were still running stores this autumn.
It was built to keep food cold. Defrost is a normal command, so changing it doesn’t trip an alarm. The attackers didn’t need to break anything. They used the equipment exactly as it was designed to be used.
The damage is physical and quick. Food-safety rules mean warm stock has to be destroyed, and some units can’t be repaired. There is no ransom to pay and no backup to restore from.
It won’t stop at fridges. Building management, heating and cooling, lighting, energy, warehouse automation and self-checkout all look much the same. Refrigeration is just where it’s been proved first.
6. What I would do now
This week. Write to every refrigeration and building-services contractor and ask for a list of controllers in your estate that can be reached from the internet, with make, model and firmware. Take anything out of support off the internet straight away. If remote monitoring really is essential, put it behind one managed VPN or gateway that only the contractor can reach. Change every default password. And make sure someone gets woken up when a cabinet starts warming overnight, using a temperature sensor that doesn’t depend on the controller.
This quarter. Budget for replacing end-of-life controllers as capital spend, not as a maintenance job. Put OT security into facilities contracts: asset registers, patching, remote-access standards and a duty to tell you about incidents. Bring store OT into the SOC’s view, so that the same setting changing in a dozen stores at midnight is treated as a security incident, not a facilities ticket for the morning.
This year. Start treating each store as a small industrial site. Separate OT from corporate and payment networks. Have refrigeration, building management and warehouse automation properly assessed by people who know OT. Then rehearse a cold-chain incident with operations, your insurers and your food-safety team, before you have to do it for real.
The attackers have now shown twice in three weeks that they can reach the physical side of the business. Every retail board should be asking whether its security programme can reach it too.
7. How LRQA Cyber can help
We have been building our OT capability for exactly this kind of problem, and we can help in three ways. They are designed to be taken in order, although most clients start wherever their biggest gap is.
Advisory: find out what you have and who owns it. Our advisory team works with your security, property and facilities leads to build a proper inventory of store and warehouse OT, including the kit your contractors manage on your behalf. We assess it against the CERT-FR and vendor guidance issued since October, review your facilities contracts for security obligations, and give you a costed plan for replacing end-of-life controllers. We will also help you get ready for the Cyber Resilience Act and for the questions your insurers are going to start asking.
OT testing: find out what an attacker can reach. Our offensive security team tests store OT the way these attackers approached it. We start from the outside, looking for controllers and building systems that can be reached from the internet, then test remote-access routes, contractor connections and segmentation between OT, corporate and payment networks. Testing is carried out with care for live equipment and food safety, agreed with your operations team in advance, and every finding comes with a practical fix your contractors can act on.
OT monitoring: know when it happens. In time, we plan to extend our 24×7 SOC to watch store OT alongside IT, so that a setpoint changing across a dozen stores at midnight raises an alert with an analyst, not a facilities ticket the next morning. We are building this now and would welcome early conversations with retailers who want to shape it.