The key facts

  • Hackers used the defrost function of refrigeration systems, raising the temperature to ~50°C; Danfoss, Copeland and Dixell systems were affected
  • French Economy Minister Roland Lescure: around 700 distribution centers and ~500 stores were hit
  • Albert Heijn in the Netherlands halted distribution centers 'preventively' after an attack attempt; no link between the incidents has been established

Attack on refrigeration systems in France

In France, hackers attacked cooling systems used by several major supermarket chains, leaving refrigerated display cases empty. The attackers remotely manipulated the systems, activating the defrost function and raising the temperature to approximately 50°C, which threatened stocks of fresh and frozen products. Systems from Danish manufacturer Danfoss, American Copeland and Italian Dixell were affected. Affected stores disconnected the equipment from the power grid; the incident raised concerns about product losses and operational disruptions.

Scale and government response

French Economy Minister Roland Lescure told parliament on Tuesday that around 700 food distribution centers were affected, with initial estimates putting the number of attacked stores at about 500. Dominique Schelcher, head of the Cooperative U group, called the attack 'unprecedented, extremely serious and unacceptable,' noting that an attack on equipment for keeping fresh products is 'an attack on the French food chain' (post on X).

Incident in the Netherlands

On Monday, the largest Dutch chain, Albert Heijn, announced that operations at several distribution centers had stopped after the systems were 'preventively' shut down due to an attempted cyberattack. No link between the French and Dutch incidents has been established, but both demonstrate the vulnerability of the infrastructure that keeps food safe.

Expert assessments

Kevin Tellier, a cybersecurity engineer at the French firm Synacktiv, called it one of the first large-scale cyberattacks to directly affect the daily lives of the French, and noted that the attack was not sophisticated: 'A 15-year-old teenager could have done it.' He warned that AI could expand the capabilities of attackers with little experience. Rafe Pilling, senior director of threat intelligence at Sophos, said the incidents illustrate 'two different but equally important' risks: in France, direct physical consequences; in the Netherlands, disruptions to digital services and operations. According to him, cyber risk in retail is now a business continuity issue, not just an IT one. Asked whether this points to a deliberate strategy against food security, Pilling replied that it is too early to draw such conclusions: 'We do not yet know who is responsible and what their motives are.'

Vulnerability of operational technology

Tellier noted that operational technology (OT) 'is often forgotten and has been underestimated for decades.' Synacktiv had previously reported vulnerabilities in Danfoss systems: three years ago, colleagues logged on to the control panel while reporting a vulnerability; Danfoss cooperated and released a patch within three months, but it is unclear why the same vulnerability resurfaced in 2025. Danfoss said the affected models are outdated and not eligible for security updates. Updating OT equipment is difficult: sometimes a USB drive must be manually connected to each device. Tellier also pointed to internet-accessible management interfaces and to the fact that supermarkets had not recognized the financial risks of cyberattacks. Centralized management reduces costs but creates single points of failure that require regular audits.

'Cyber battlefield' and recommendations

Pilling emphasized that centralized platforms can amplify the consequences of compromise, and that food distribution systems could become a target for destabilization without a direct strike on classic critical infrastructure. He recommended that retailers inventory refrigeration systems, check vendor support, restrict remote access to trusted networks with strong authentication and network segmentation, isolate legacy controllers, and monitor unexpected changes. 'Regardless of who is ultimately responsible, the attack on refrigeration systems in France should be a wake-up call for retailers and operators of connected infrastructure,' he said, adding that systems supporting the food supply are now part of the 'cyber battlefield.'