How supermarkets became targets of cyberattacks

8 NOVEMBER 2026

150 Intermarche stores in France found their refrigeration systems running at 50 degrees Celsius in October 2026.
Three weeks later, the same pattern repeated in supermarkets across Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Germany and Sweden.
Outlets of Carrefour, Spar and Delhaize were hit, and even a few restaurants run by furniture maker Ikea.
Still, no one asked for a ransom. No customer data was stolen, and no database has turned up on the dark web.
For a decade, the image of a cyberattack has been a locked screen, a crypto wallet address and a database of stolen credentials. Criminals attack for profit, either by encrypting systems and demanding payment or by stealing data that can be sold.
This hack was completely different. The attackers only wanted to spoil food, empty shelves and cause public anxiety.

Central controllers for refrigeration

Modern supermarkets manage refrigeration through central controllers, many connected to the internet so that maintenance contractors can adjust settings without a site visit.
That convenience opened the door to a hacker who did not need to invent anything new. They just had to trigger the “forced defrost” function, pushing target temperatures to 50 degrees Celsius, and stretching the defrost cycle from one hour to eight.
It was a normal command sent to an exposed controller.

Software issues

The weak link appears to be software. Controllers in older systems were built for convenience and reliability, not internet-grade security, and they typically stay in service for 10 to 20 years, far beyond the support cycle of ordinary software.
Hardware installed today may outlive several generations of the systems used to manage it. But newer equipment was not spared either.

Precautions needed

Critical infrastructure is no longer limited to power grids and hospitals. The fixes are not sophisticated.
Patch controllers promptly, and replace those out of support.
Take critical hardware off the public internet.
Put all remote access behind a VPN with multi-factor authentication.
And regulators should ask whether food retail needs mandatory standards for operational technology security.