Cyberattacks hit European grocers: French supermarket freezers hijacked, Dutch and Belgian stores disrupted
Attackers hijacked Danfoss refrigeration controllers at hundreds of French supermarkets, spoiling frozen stock; Ahold Delhaize separately hit by disruptive incident.
Attackers remotely hijacked Danfoss refrigeration control systems overnight at hundreds of French supermarkets including Intermarché, Netto, Super U, Leclerc, Carrefour Market and Monoprix, warming freezers and destroying chilled/frozen goods with per-store damage of tens to hundreds of thousands of euros. Claroty Team82 disclosed flaws in Danfoss AK-SM 800A and Copeland XWEB Pro web management interfaces in August 2026 that were since patched, but it is unconfirmed whether they were exploited here. Separately, Ahold Delhaize confirmed a security issue disrupting Albert Heijn, Etos, Gall & Gall and Delhaize stores in the Netherlands and Belgium, halting distribution centers and knocking websites and apps offline.
- Danfoss refrigeration controllers remotely hijacked at hundreds of French stores overnight
- Freezers set to warm, spoiling stock; losses of tens to hundreds of thousands of euros per store
- Claroty-disclosed AK-SM 800A and XWEB Pro flaws patched in August; exploitation unconfirmed
- Ahold Delhaize security issue disrupts Dutch and Belgian stores, distribution centers, apps
Full article663 words · extracted from helpnetsecurity.com · click to collapse
European food retailers have been affected by two separate disruptive cyberattacks: In France, several supermarket chains have had their freezers tampered with and chilled/frozen products destroyed, while in the Netherlands and Belgium workers at stores owned by Dutch multinational Ahold Delhaize have been dealing with disruption resulting from an unspecified “security issue”.
Freezers turned into ovens overnight
French news channel BFMTV reported today that hundreds of stores across the country were affected by a cyberattack on the refrigeration control systems manufactured by Danish company Danfoss.
Apparently, the control systems were hijacked remotely by attackers on Sunday night and early Monday morning. Once they arrived at work on Monday, workers were faced with defrosted and spoiled products in fridges and freezers that warmed them instead of cooling them.
According to the news outlet, many shops run by Groupement Mousquetaires (Intermarché, Netto), Coopérative U (Super U, Marché U), and Leclerc were affected and have suffered damage reaching tens or even hundreds of thousands of euros.
“An internal communication from the Intermarché network, dated Monday, October 12, which we were able to consult, confirms the existence of a cyberattack that occurred during the night at Danfoss,” BFMTV reported.
“A crisis meeting was scheduled for Monday at 11 a.m. between several service providers in the refrigeration sector, including Axima, a specialist in the installation and maintenance of refrigeration equipment, and Danfoss, a supplier of the regulation systems affected by the attack.”
Jonathan Le Borgne, the creator of Je Bosse En Grande Distribution, a podcast and blog focusing on topics related to the French grocery retail business, confirmed that the hackers took control of the (remotely controllable) Danfoss refrigeration control systems. He also said Carrefour Market and Monoprix stores were affected.
Information shared by workers at various affected shops showed that some were able to salvage some of the product due to their systems having been hit closer to the opening hours, or managers having received alerts about the potentially destructive changes effected by the attackers.
Known flaws in refrigeration controllers, but no confirmed link
In early August 2026, security researchers with Claroty’s Team82 disclosed multiple vulnerabilities affecting the web-based management interfaces of Danfoss AK-SM 800A refrigeration controllers and Copeland XWEB Pro supervisory controllers.
Both vendors have since released updated firmware that fixed the vulnerabilities.
Some of these flaws could allow attackers to hijack the devices and through them interfere with the refrigeration infrastructure they are used to manage, but it’s currently unknown whether they have been exploited in these latest attacks.
In late August 2026, refrigeration units at military commissaries across the US were similarly affected, and there was speculation (never officially confirmed) that it was caused by a cyber intrusion, since the refrigeration units were set to “defrost”.
Ahold Delhaize cybersecurity incident
Dutch retail giant Ahold Delhaize also confirmed today that it is experiencing a security issue within its network.
“Our teams are taking steps to assess and mitigate the issue. This includes taking some systems offline to help protect them. At this time, our stores are open and serving customers,” the multinational said.
“Protecting our infrastructure in the best interest of our customers, associates and partners is a top priority. We apologize for any inconvenience this issue may have caused customers and partners.”
Work at several Albert Heijn distribution centers has come to a stop.
Shops and drugstores under Ahold Delhaize’s Dutch brands (Albert Heijn, Etos and Gall & Gall) and Belgian Delhaize stores have been affected, as well as the brands’ websites and apps, which are still offline.
Online customers cannot place orders, customers in physical locations are seeing old prices on electronic shelf signs, and employees at Ahold Delhaize’s American supermarket chain Stop & Shop complained online of being unable to access their schedules and paystubs.
There is currently no indication that the two cyberattacks are connected.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!