French supermarket hack exposes cyber vulnerabilities in retail

WHEN Jeremy Beziaud arrived at the Intermarche supermarket he manages in France’s Normandy region on Oct 12, he found freezers heating at 40 degrees Celsius, and a cold room ventilator for fish that had risen to 70 deg C. 

Monitoring teams had alerted him to temperature irregularities in the refrigeration system earlier that morning.

But what he initially assumed to be an isolated issue at his store in Saint-Symphorien-le-Valois turned out to be part of a major cyberattack that had been launched on fridges and freezers across hundreds of French supermarkets.

Even though his equipment was running again later that day, Beziaud had to dispose of 3,000 euros (US$3,370) worth of products. “I threw out all the fresh food,” he said. “I didn’t want to take any risks since the cold chain had been broken.”

It will take nearly a week to replenish the stock that has been lost, but customers have been supportive, he added. “They understand how serious the situation is.”

No group has publicly claimed responsibility for the hack. 

The disruption in France, which affected 700 stores, including those from the Intermarche, Cooperative U and Carrefour chains, is the latest in a series of cyberattacks on retailers.

In 2025, hackers targeted UK supermarket the Co-op’s operations, affecting deliveries, leaving some stores short of fresh food and causing the grocer a sales hit of more than £200 million (US$267 million).

Marks & Spencer was also struck by a major cyberattack in 2025, disrupting online services for four months and contributing to an estimated £300 million fall in operating profit. 

Experts said that the incidents expose how vulnerable food retailers are to cyberattacks.

Grocers often run on thin margins with tightly calibrated supply chains and large volumes of perishable products, which can be spoiled by even relatively short disruptions. They are also a vital element of countries’ food security, making them an attractive target for attackers who want to create chaos.

Hackers are “targeting retail because they’re weak and it can have a massive impact on society”, said Harjinder Singh Lallie, reader in cybersecurity at the University of Warwick.

“We’ve got this kind of snowball effect: As other cyberattackers see that this is an area that is very underprepared, more of them are targeting the retail sector.”

A spokesperson from Groupement Mousquetaires, which owns Intermarche, said that 300 of its stores were attacked. Carrefour said 80 supermarkets were affeccted.

The attacks on M&S and Co-op in the UK were reportedly attempts to extort money from the companies, and investigations into both centred on groups known for using “social engineering”, in which intruders dupe people into giving up their credentials or providing access in some other way.

A low priority

The hacks in France were executed through centralised fridge controllers, connected to the Internet, which allow contractors to remotely monitor temperatures.

Attackers gained access to some of those systems and manipulated their settings, triggering prolonged defrost cycles that caused refrigerators and freezers to heat up.

Danfoss, one of the manufacturers whose equipment was affected, said most of the compromised devices were obsolete models that no longer received software or security updates.

The need to manage stock and meet food safety standards mean that retailers have invested in the Internet of things, connecting their infrastructure to the Internet to allow for real-time monitoring and data collection.

However, these devices create vulnerabilities over time, as they age, and as their owners neglect to keep up with evolving cyberthreats.

Bill Moore, CEO of cybersecurity firm Xona Systems, said that refrigeration and heating, ventilation and air-conditioning systems in retail stores are often 10 to 15 years old, installed when cyberthreats were less prominent.

Retailers, he said, had fallen behind manufacturers in recognising the risks posed by connected equipment. “It has not been a top consideration for many of them.”

Traditionally, the systems that control physical equipment such as machinery and refrigerators were separated from corporate IT networks, which helped limit the risk of an intrusion spreading from one environment to another.

Remote maintenance, software updates and other connections can expose equipment to the Internet, potentially creating opportunities for attackers.

“Retailers depend on vast networks of interconnected technologies to keep their businesses running,” said Luca Berni, threat intelligence director at Palo Alto Networks Unit 42 in Paris. “As retailers expand their digital operations, maintaining consistent security across every location, platform and partner becomes increasingly difficult.”

The disruption to business that these kinds of attacks can cause for grocers is severe. Food perishes quickly, and defrosting freezers can cause a lot of damage. 

“There would have been a lot of water on the floor,” Alan Foster, associate professor in the Heating and Cooling Group at London South Bank University. “Stuff would have gone really gooey and disgusting, so removing it wouldn’t have been simple.”

The clean-up and restart operations are also time-consuming. Before restarting the fridges, supermarkets would likely need safety checks and, in some cases, refrigeration engineers to assess the damage.

Some cabinets could be back in operation the same day – as was the case at Beziaud’s store – while more badly damaged equipment may need replacing.

Mousquetaires’ spokesperson said that its refrigeration supplier is responsible for cleaning up its systems. Cooperative U and Carrefour did not respond to requests for comment.

Retailers’ low margins mean that they have often not prioritised investing in securing their systems, experts said.

“They don’t print money as a sector, which means they’ve got to be very lean in how they operate, which means they are more exposed to getting hit,” said Laura Duncan, cybersecurity partner leading retail and consumer at PwC in London.

She added that retailers are increasingly looking at how to recover from a hack, including ensuring their business can run offline if required: “Could you do things manually with pen and paper?”

Security experts warned that the threat could become harder to contain as attackers make greater use of artificial intelligence, which may help criminals identify weaknesses, develop convincing phishing messages or accelerate parts of an intrusion. 

Cybercriminals frequently reuse tactics that have proved successful, raising the risk that vulnerabilities exposed by one attack are subsequently targeted by others. 

The attacks should be a wake-up call for retailers and governments, experts said.

Grocers are “now clearly kind of open targets”, the University of Warwick’s Dr Singh Lallie said. “They’ve been announced out there in the cybercriminal fraternity that these are easy target.” BLOOMBERG