A cyberattack breaking the cold-chain in supermarkets: an alarm signal sent to connected industrial systems

TLTR

• A cyber attack breaks the cold chain at many supermarkets: after initially targeting hundreds of French food retails stores, the cyberattack on retail refrigeration controllers has spread across Europe;
• Potential vulnerabilities and attack scenarios: Orange Cyberdefense experts think it could have exploited old or poorly secured refrigeration supervisors: exposed interfaces, insufficiently protected remote maintenance and weak passwords…; 
• A threat that goes beyond retail: this incident is a reminder that the compromise of connected industrial systems (IT/OT) is constantly increasing and can disrupt essential activities. Securing them through updates, access control and reduction of web exposure and leaks - is becoming urgent.

Industrial systems as increased targets

During the night of 11 to 12 October, several hundred French supermarkets were victims of a cyber-attack targeting their refrigeration equipment. 3 weeks after this first wave, other European countries have been impacted as well. 

Breaking the cold chain on a large scale

This story is unfolding as 15 Carrefour supermarkets in Belgium have been hit by the cyberattack during the night of 1 to 2 November. Other food retail stores, owned by Ahold Delhaize, Intermarché, Colruyt and Ikea as well have reportedly been targeted as well in Belgium and Luxembourg. In Sweden, ICA and Coop retail brands went through similar ordeals, reports the french newspaper Le Figaro⁽¹⁾. According to belgium’s Le Soir newspaper ⁽²⁾, Spar, shop & go convenience stores at Q8 service stations and Proxy Delhaize mini-markets have been also targeted. Moreover, The Guardian says stores in Estonia, Ireland, Finland and the Netherlands are concerned as well ⁽³⁾. 

By remotely modifying the parameters of refrigeration supervisors, the attackers have caused the breaking of the cold chain in many stores, with a significant economic and above all health impact. This incident perfectly illustrates the rising ability and will of cybercriminals and hacktivists to attack connected industrial systems - also called IT/OT systems - as today’s prime targets. 

The cyberattacks affecting supermarkets across the UK and Europe show how incidents can quickly extend beyond IT disruption, affecting food supplies, businesses and consumers ⁽⁴⁾, says Charl van der Walt, Global Head of Security research at Orange Cyberdefense.

The consequences of this cyberattack are very real: beyond food and economic waste, breaking the cold chain on such a scale can have dire health and food poisoning consequences as well and the matter is not to be taken lightly. It marks an underlying trend among cyberattackers: targeting industrial systems or IT/OT (standing for Informational Technologies/Operational Technologies) systems with a very real impact on citizens' daily lives. 

A dead cold procedure

The attackers reportedly modified the settings of refrigeration supervisors remotely, from Danfoss, Copeland, and Dixell brands ⁽⁵⁾. Doing so, they have notably succeeded in forcing the activation of de-icing and the partial neutralization of food temperature-related alarms. The vulnerabilities that allowed attackers to break the cold chain were linked to older generation cold-monitoring devices, which no longer received security updates. 

Unlike a ransomware attack, no ransom was requested and no data exfiltration has been reported at this stage. It is a show of force whose impact is mainly operational, financial and health. 

Several leads regarding the initial compromise

After the initial wave of the cyberattack in France, the Paris public prosecutor’s office has already opened an investigation. If at this stage no official cause for the origin of the compromise is established, several credible hypotheses can be raised: 

• Administrative interfaces exposed on the internet; 
• Insufficiently secure remote maintenance access; 
• Weak passwords and / or unupdated equipment.  

This campaign is probably still ongoing: other industrial sectors, other countries and other technologies could be impacted, as long as assets are still exposed. ONYPHE ⁽⁶⁾ lists 6,212 IP addresses in 95 countries that expose the Danfoss interface on the Internet, nearly half of them in France. For its part, Modat ⁽⁷⁾ has about 5,000 Danfoss SM800A supervisors and nearly 4,000 Copeland equipment on display, mainly in the United States and Italy, says Pierre-Yves Amiot, Operations Director of  Orange Cyberdefense's CERT. 

A threat that goes beyond large-scale distribution

This attack marks a turning point: a few changes in parameters were enough to cause large-scale economic and health consequences.

This campaign demonstrates that cybersecurity is no longer just about information systems. Industrial equipment, technical infrastructure and connected objects that drive the physical world are now targets in their own right, says Christophe Dernys, Head of Trusted Solutions at Orange Cyberdefense.  

The procedure that involves exploiting one or more flaws in the supply chain of one or more brands can also be applied to other essential or even critical resources and industrial sites: logistics warehouses, the agri-food industry, pharmaceutical sites, production plants, critical technical infrastructure, energy, hydraulic or nuclear.  

For CISOs, industrial managers and business divisions, the question is no longer whether these systems need to be secured, but rather how quickly this securing can be implemented, concludes Christophe Dernys. 

Footnotes

⁽¹⁾ “Après la France, des milliers de frigos de supermachés de nouveau piratés ce lundi en Europe”, Thibaut Déléaz, 02.11.2026, lefigaro.fr: https://www.lefigaro.fr/conso/apres-la-france-des-milliers-de-frigos-de-supermarches-de-nouveau-pirates-ce-lundi-en-europe-20261102 
⁽²⁾ “Shop fridges and freezers across Europe hit by fresh suspected cyber-attack”, 02.11.2026, theguardian.com: https://www.theguardian.com/world/2026/nov/02/supermarket-freezers-across-europe-hit-by-second-suspected-cyber-attack 
⁽³⁾ “Les systèmes frigorifiques de plusieurs supermarchés impactés par un incident informatique en Belgique”, lesoir.be, 02.11.2026: https://www.lesoir.be/780363/article/2026-11-02/les-systemes-frigorifiques-de-plusieurs-supermarches-impactes-par-un-incident
⁽⁴⁾ “Cold war: UK food suppliers hit by European cyberattacks”, Saskia Koopman, 03.11.2026, cityam.com: https://www.cityam.com/uk-food-suppliers-hit-by-european-cyberattacks/  
⁽⁵⁾ Cert-FR alert bulletin, 12.10. 2026: https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/  
⁽⁶⁾ Onyphe is a French cybersecurity research platform. It collects information accessible on the Internet - for example, exposed services, domain names or IP addresses - in order to help cybersecurity teams monitor their exposure area and identify risks.  
⁽⁷⁾ Modat.io is an intelligence platform on assets connected to the Internet. In particular, it identifies exposed industrial equipment – such as refrigeration supervisors – to help assess their exposure and the associated risks.