Two separate cyber incidents hit European food retailers within days of each other, revealing how vulnerable physical infrastructure has become to digital attacks. In France, attackers remotely manipulated refrigeration controls to destroy perishable inventory. In the Netherlands and Belgium, a separate security issue disrupted stores owned by the retail giant Ahold Delhaize.
These incidents serve as a reminder that cybercrime doesn't always mean stolen data—sometimes it means rotting meat.
What Happened in France
Danish company Danfoss manufactures the refrigeration control systems used across hundreds of French supermarkets. According to reporting by BFMTV, attackers gained remote access to these systems over a weekend and changed settings that caused freezers to warm instead of cool.
Workers arriving at stores on Monday morning found thawing and spoiled products. The financial damage at individual locations reached tens or hundreds of thousands of euros per store, with multiple chains affected including Intermarché, Netto, Super U, Marché U, Leclerc, Carrefour Market, and Monoprix.
A crisis meeting was convened the same day with Danfoss, Axima (a refrigeration maintenance firm), and other sector service providers. An internal Intermarché communication confirmed the cyberattack occurred during the night and targeted Danfoss regulation systems specifically.
Some stores escaped full damage because systems were hit closer to opening hours, or managers received alerts in time to intervene.
The Vulnerability Behind the Attack
In August 2026, Claroty's Team82 research team published findings on multiple vulnerabilities affecting Danfoss AK-SM 800A refrigeration controllers and Copeland XWEB supervisory systems. Both vendors released firmware patches addressing the flaws.
The vulnerabilities affected web-based management interfaces used for remote monitoring. An attacker who exploited them could potentially manipulate refrigeration settings or interfere with cooling infrastructure. Whether the recent attacks actually exploited these known vulnerabilities remains unconfirmed.
The timing is notable. Patches were available for roughly two months before the attack occurred. Organizations that failed to apply updates left their systems exposed.
Ahold Delhaize Faces Separate Issue
Around the same time, Dutch multinational Ahold Delhaize confirmed a security issue within its network. The company took systems offline to contain the problem and protect infrastructure.
The disruption affected multiple brands across the Netherlands and Belgium: Albert Heijn, Etos, Gall & Gall, and Delhaize stores all experienced problems. Digital shelf signs showed outdated pricing. Online orders became impossible. Employees at Stop & Shop, the company's American chain, reported being unable to access schedules and paystubs.
Distribution centers for Albert Heijn halted operations. The company stated that stores remained open and serving customers, but the incident clearly strained operations across multiple markets.
Ahold Delhaize has not disclosed the nature of the security issue or its root cause.
Why It Matters
These incidents expose a gap between how organizations think about cybersecurity and where actual risks lie. When security teams discuss protecting retail networks, the conversation centers on point-of-sale systems, customer databases, and payment processing. Nobody wants to be the person who warned the board about freezer firmware.
But attackers increasingly understand that physical infrastructure is less monitored and less patched than enterprise IT systems. Refrigeration controllers, HVAC systems, and building management platforms sit in an uncomfortable middle ground: connected enough to be remotely accessible, neglected enough to be exploitable.
The financial impact here is immediate and tangible. Spoiled inventory, emergency repairs, lost sales, and reputational damage compound quickly. This is not a theoretical threat—it is a direct operational hit that small retailers may struggle to absorb.
There is also a food safety dimension. For hospitals, care homes, and other institutions that rely on grocers for meal preparation, prolonged refrigerator failures create downstream risks. The attack surface extends beyond the retailers themselves.
Who Should Care
| Stakeholder | Primary Concern |
|---|---|
| Grocery retailers | Audit all network-connected operational technology, not just IT systems |
| Food service operators | Verify backup power and monitoring for cold storage |
| Cybersecurity teams | Include HVAC, refrigeration, and building management in vulnerability tracking |
| Insurers | Reassess coverage assumptions for physical infrastructure attacks |
| Food safety regulators | Consider whether cold chain failures require mandatory reporting |
What to Watch Next
Investigations are ongoing in both cases. If French authorities determine that the known Danfoss vulnerabilities were exploited, expect renewed attention on patching discipline for operational technology. Retailers with similar refrigeration setups should audit whether their systems are exposed to the internet and whether firmware updates have been applied.
For Ahold Delhaize, the scope of the network issue remains unclear. The company has not confirmed whether customer data was accessed, which will be the next major question.
Key takeaways
- Physical infrastructure like refrigeration systems carries cybersecurity risks that retailers often overlook
- Known vulnerabilities in these systems had patches available for roughly two months before the French attack
- The financial damage from disrupted freezers rivals or exceeds typical data breach costs
- Retailers should audit all internet-connected operational technology, not just IT systems
- These two incidents appear unrelated but share the common thread of vulnerable supply chains
Frequently asked questions
Was customer data stolen in either incident?
Neither company has confirmed data access by attackers. The French case appears focused on destroying inventory rather than exfiltrating information.
Were the two attacks connected?
Investigators have found no indication linking the French refrigeration attack to Ahold Delhaize's security issue. They appear to be separate incidents.
How did attackers access the refrigeration controls?
The Danfoss systems have web-based management interfaces. If these were exposed without proper access controls or if unpatched vulnerabilities existed, remote access was possible. The exact initial access vector is still under investigation.
What can other retailers do to protect similar systems?
Audit all network-connected operational technology, apply vendor patches promptly, restrict internet exposure through VPNs or network segmentation, and include physical infrastructure in incident response planning.
Did the known August 2026 vulnerabilities enable the attack?
The vulnerabilities existed and patches were available, but authorities have not confirmed whether they were exploited. The investigation is ongoing.