Cyberattack forces European supermarket fridges into continuous defrost cycle

A cyberattack targeting refrigeration control systems has pushed supermarket cooling equipment across Europe into a continuous defrost cycle, with affected units reportedly being driven to 50 degrees Celsius. According to Tom's Hardware, citing a report from the French newspaper La Dépêche, several major retail chains have been caught up in the incident, and the disruption extends beyond the cold aisles to deliveries and the electronic shelf labels that drive in-store pricing.

What happened

The attack centres on refrigeration controls made by Danfoss, Tom's Hardware reports, with deployments used by the French supermarket chains Intermarché, Leclerc and Coopérative U.

The most striking symptom is the defrost behaviour. Rather than simply switching fridges off, the attackers have reportedly set the units to defrost continuously at 50 degrees Celsius — a temperature at which cold storage effectively stops being cold storage. Perishable stock held in those cabinets cannot remain within safe temperature ranges for long, which leaves stores facing likely food waste even once the systems are brought back under control.

Dominique Schelcher, president of Coopérative U, confirmed the incident on Monday morning, saying a cyberattack had been affecting the refrigeration production facilities of several stores in the cooperative's network since the previous night. He said teams had been mobilised to fix the problem and that an investigation would follow, describing the incident as "extremely serious" in remarks carried by the Tom's Hardware report.

Disruption beyond the fridges

Alongside the refrigeration fault, the attack is also reported to be affecting deliveries and electronic shelf labels — the digital price displays that retailers update centrally rather than by hand. When pricing infrastructure is disrupted, stores are left choosing between selling goods at prices they cannot verify or suspending sales, while restocking chilled goods becomes complicated if stores cannot reliably keep them cold.

At the time of reporting, the coverage does not name a perpetrator or a motive, and there is no public detail on how the attackers gained access to the control systems in the first place.

Why it matters

The incident is a rare and unusually physical demonstration of what operational technology insecurity looks like in practice. Cyberattacks on retailers are usually discussed in terms of stolen payment data or encrypted file servers; here the failure mode is warm fridges, spoiled stock, and shops that cannot price or reliably receive goods. The damage lands in the real world within hours, not weeks.

The apparent blast radius also highlights the risk of vendor concentration in building controls. Competing chains — Intermarché, Leclerc and Coopérative U — reportedly share the same Danfoss control platform, so a single intrusion or vulnerability can cascade across a whole market segment rather than being contained within one company. That turns a security incident at one equipment supplier into a sector-wide operational problem.

For security teams, the case is a reminder that refrigeration controllers, electronic shelf labels and logistics systems are networked computers too. They are often installed, connected and then left unpatched for years, and they sit at the awkward boundary between IT and facilities management where ownership and monitoring responsibilities are frequently unclear. The promised investigation should clarify how the attackers got in, but the outcome is already a concrete argument for segmenting and watching industrial and IoT equipment with the same rigour applied to servers and endpoints.