European Supermarkets Hit by Cyberattack Disrupting Fridges and Pricing Systems
Hackers forced continuous defrost cycles on refrigeration units and disrupted electronic shelf labels across several major retail chains in Europe.
Key points
- Danfoss-made refrigeration controls were manipulated to run continuous defrost cycles at 50 degrees Celsius.
- French chains Intermarché, Leclerc, and Coopérative U confirmed the impact on their store networks.
- Dutch retailers Albert Heijn, Etos, and Gall & Gall reported website outages and pricing label failures.
A cyberattack has disrupted operations at major supermarket chains across Europe, affecting both physical refrigeration systems and digital pricing infrastructure. According to reports from Tom's Hardware and La Dépêche, the incident involves multiple retailers and has caused significant operational interruptions. The attack reportedly struck major supermarket chains, disrupting refrigeration control systems and impacting deliveries and in-store pricing.
In plain English
The core of the disruption involves refrigeration units manufactured by Danfoss. The report states that the units have had their automatic defrosting systems activate, but that hackers have also configured the function into a continuous, forced defrosting cycle. The temperature was set to 50 degrees Celsius. Normally, this cycle runs for only two hours a day, but the attackers forced it to run indefinitely.
View the original post on X
This manipulation of industrial control systems is unusual for retail cyber incidents. Most attacks target data or payment systems, but this one directly altered the physical environment of the stores. Sources reportedly described "a wave of heat" escaping from fridges and freezers. This direct manipulation of hardware settings poses immediate risks to inventory integrity, with early reports indicating losses are already approaching 300,000 euros.
The background
French supermarket chains Intermarché, Leclerc, and Coopérative U were among those affected by the refrigeration controls issue. Dominique Schelcher, president of Coopérative U, confirmed that the cyberattack impacted refrigeration production facilities in several stores in their network. He stated that teams were mobilized to address the problem and promised a full investigation into the incident, describing it as extremely serious.
In the Netherlands, NOS reported a separate but potentially related cybersecurity incident affecting Albert Heijn, Etos, and Gall & Gall. These retailers experienced website takedowns that impacted online deliveries. Additionally, electronic shelf labels were compromised, causing disruptions to in-store pricing displays. Albert Heijn stated they took preventive measures, including the temporary shutdown of certain systems, to protect their IT environment.
What changes now
Financial losses from the refrigeration attack are already estimated to be approaching 300,000 euros, with potential nationwide costs running into several million euros. It remains unclear whether the attacks in France and the Netherlands are connected or part of a broader coordinated campaign. Belgium's Delhaize chain, which is part of the Albert Heijn group, also reported disruptions.
Images from Amsterdam show stores warning customers about price discrepancies and the suspension of loyalty programs. These operational halts highlight the vulnerability of connected retail infrastructure. While specific details on the threat actor remain unknown, the incident demonstrates the expanding scope of cyber threats into operational technology and physical store environments. The report notes that it is unclear at this stage how widespread either of the incidents is.
What to do and how to stay safe: Danfoss
- Review access controls for all industrial control systems and refrigeration networks to ensure they are isolated from general corporate IT.
- Monitor system logs for unusual configuration changes, particularly those involving temperature settings or maintenance cycles like defrosting.
- Verify the integrity of electronic shelf label data and pricing systems to detect potential manipulation or unauthorized updates.
- Establish clear incident response protocols for operational technology failures, including manual overrides for critical cooling equipment once vendors provide guidance.
General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which retailers were confirmed to be affected by the refrigeration cyberattack?
Intermarché, Leclerc, and Coopérative U in France, and Albert Heijn, Etos, Gall & Gall, and Delhaize in the Netherlands and Belgium.
How did the hackers manipulate the refrigeration units?
They forced the automatic defrosting function to run continuously and set the temperature to 50 degrees Celsius.
Is there a confirmed connection between the French and Dutch incidents?
It is currently unclear whether the two attacks are related or how widespread either incident is.
