A sophisticated and deeply disruptive cyberattack has struck hundreds of supermarkets across Europe, plunging retail stores into operational chaos after hackers remotely manipulated commercial refrigeration systems to defrost overnight. The malicious campaign left refrigerators and freezers completely compromised, raising internal temperatures to extreme levels and destroying massive quantities of fresh food products while inflicting millions of euros in financial damages.
The unprecedented incident targeted major retail and grocery chains throughout Europe, including retail heavyweights such as Auchan, Carrefour, E.Leclerc, Intermarché—which is owned by Groupement Mousquetaire—and Monoprix, according to reports from Reuters and various European media outlets. While the vast majority of the destruction and store closures were concentrated in France, where hundreds of locations bore the brunt of the assault, the coordinated cyber intrusion also affected food retailers and grocery stores in Belgium, Germany, the Netherlands, Poland, Portugal, and Spain.
The scale of the disruption quickly forced retail executives and corporate leaders to address the crisis publicly. Cooperative U CEO Dominique Schelcher took to social media platform X to confirm that multiple stores operating under the Hyper U, Super U, U Express, and Utile banners had been directly hit by the unauthorized intrusions.
"Our teams are fully mobilized, in coordination with refrigeration specialists, to restore the situation as quickly as possible. An investigation will be necessary to shed full light on this attack," Schelcher stated in a post addressing the crisis. Emphasizing the gravity and potential societal impact of targeting critical retail infrastructure, he added, "Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented. It is unacceptable."
According to reports from French news outlet BFM TV, more than 300 individual supermarket locations were affected in France alone. Financial analysts and corporate representatives estimate that the resulting inventory losses, coupled with operational downtime and equipment restoration efforts, will reach millions of euros.
Preliminary findings indicate that the malicious actors managed to compromise advanced refrigeration controllers manufactured by Danish industrial technology company Danfoss. By gaining unauthorized remote access, the perpetrators systematically altered the operational settings of commercial refrigerators and freezers during the dead of night. The altered controllers reportedly forced the equipment to continuously defrost, driving internal temperatures up to a staggering 50 degrees Celsius, or 122 degrees Fahrenheit. The unauthorized thermal spike persisted for roughly six hours before bewildered store employees arrived for the morning shift and discovered the catastrophic failure.
Security researcher Lukasz Olejnik described the bizarre and destructive physical aftermath of the digital breach on X, noting, "Someone remotely took over refrigeration controllers and made them defrost. Target temperature set to 50°C. Staff opening freezers in the morning were hit by a wave of hot air."
The large-scale digital assault unfolded roughly two months after cybersecurity firm Claroty publicly disclosed a series of severe vulnerabilities affecting the Danfoss AK-SM 800A management platform. According to Claroty’s security advisories, the identified flaws could potentially allow unauthenticated, remote attackers to bypass security boundaries, execute arbitrary code on targeted systems, and inject arbitrary configuration directives.
At the time of the disclosure, Claroty reported identifying thousands of Danfoss AK-SM 800A management interfaces that were publicly accessible over the internet. The security firm strongly urged affected customers and industrial operators to immediately upgrade their management systems to firmware version R4.3.1, which contained the vital patches necessary to close the security gaps.
"Because these systems provide centralized management of refrigeration equipment, compromising the management interface can have significant operational consequences," Claroty warned in its technical research publication detailing the vulnerabilities.
Despite the alarming timeline and the technical parallels between the disclosed platform flaws and the nature of the European supermarket breach, investigators have not yet officially confirmed whether the hackers exploited the specific vulnerabilities highlighted by Claroty. As technical teams, refrigeration specialists, and cybersecurity investigators continue their forensic analysis across multiple European jurisdictions, retail organizations are left assessing their remote management exposure and reinforcing defenses around critical operational infrastructure to prevent any recurrence of the unprecedented incident.
