Defrosted

The biggest attack spread across hundreds of refrigeration units in French supermarkets, which were hit by a cyberattack that caused their freezers to heat up, spoiling fresh and frozen food estimated to be worth millions of dollars. Overnight on October 12, attackers manipulated refrigeration controls at stores operated by major chains including Intermarché, Carrefour, Monoprix, E.Leclerc, and Coopérative U_, a who’s who of French grocery. The attackers raised the temperatures in fridges and freezers, with some reports describing settings reaching 122°F or higher. Food was spoiled, equipment was damaged, and many stores had to close temporarily and dispose of stock. So far, no hackers have claimed responsibility, and no reason behind the attacks has been identified.

The chief executive of Coopérative U called it an “extremely serious and unprecedented” attack, with more than 100 of the chain’s supermarkets targeted, while 180 stores from Intermarché and its Netto brand were affected. A spokesman added that another 100 shops were immediately disconnected from the internet to prevent the same thing happening to them.

Normally, supermarket freezers go through a short period of defrosting overnight, in which temperatures rise slightly, but the hackers manipulated the units to heat up and stay hot. The full scale of the attack is unclear, but figures supplied by individual chains suggest about 400 stores were affected out of 15,000 in France.

Deep Investigation

French authorities immediately opened an investigation involving the country’s cybersecurity agency, and there is already a significant lead in the investigation. The affected refrigeration systems used technology supplied by Danish company Danfoss, which said that many of the units involved were obsolete, no longer receiving security updates, or running outdated firmware. Suffice it to say that the crisis has urged customers to update supported systems and migrate legacy equipment to current-generation products.

Cybersecurity researchers had previously identified vulnerabilities in Danfoss refrigeration controllers, with research published by Claroty as recently as this August detailing flaws in the AK-SM 800A controller that could permit attackers to bypass authentication and execute code on compromised devices. French newspaper Le Monde also reported a smaller series of attacks affecting refrigeration equipment from manufacturer Dixell. In one case hackers altered defrost and temperature settings, but technicians intervened before stock was lost. It is still too early to determine whether the incidents are linked, but it is a clear warning shot over outdated systems.

Fashion Payments Hit by Hackers

The ASOS incident was from the classic cyberattack playbook, exploiting vulnerabilities in human nature and the systems used to communicate with customers. On October 6, the online fashion retailer sent an unauthorized notification to customers; a subsequent investigation found that an attacker had impersonated a trusted contact to obtain the login credentials of an employee. Those were then used to access information on third-party platforms used by ASOS.

The company confirmed that some personal information, including names and contact details, had been accessed but insisted that payment card details and account passwords were not compromised and that its website and app remained safe to use.

That has echoes of Marks & Spencer’s 2025 cyberattack, which resulted in how quickly a technology failure can become a reputational crisis. The attack, which began around Easter last year, disrupted online apparel and home orders, contactless payments, and click-and-collect services, while some stores also experienced problems with stock availability. M&S later estimated the incident would cost nearly $400 million in operating profit before insurance recoveries.

But the reputational damage extended well beyond lost sales as the disruption raised questions about the resilience of M&S’s technology after the attack. It was linked to the Scattered Spider cybercrime group, with attackers reportedly exploiting a third-party IT support provider.

For ASOS, the distinction between the affected third-party platforms and its core website is important because this was not, on the evidence currently available, a shutdown of the retailer’s ecommerce operation but rather an attack on the trust that underpins its customer relationships.

TFG Hit by Attack

Just a week later, TFG London, the subsidiary of South African retail group The Foschini Group that owns Whistles, Hobbs and Phase Eight, confirmed a cyberattack affecting its systems and the company launched an investigation. Some systems were disrupted, and the business suspended online orders as a precaution, but its physical stores remained open, although customers faced potential delays to orders and restrictions on returns. TFG said payment information managed by third parties remained secure and there is no evidence to date that the ASOS and TFG London attacks are connected.

Cross-Borders Attacks

This is far from simply a European issue. On October 12, Ahold Delhaize, whose U.S. businesses include Food Lion, Stop & Shop, Giant Food, The Giant Company, and Hannaford, said it was investigating a security issue within its network and had taken some systems offline as a precaution. Five U.S. grocery banners were affected, as were several European services, including Albert Heijn. Stores remained open, and the company insisted that it had no evidence that customer or employee data had been stolen, while the precise cause and extent of the incident has yet to be publicly established.

Albert Heijn’s experience echoes summer incidents for Coca-Cola-owned dairy brand Fairlife, which temporarily paused U.S. production after a ransomware attack compromised parts of its production systems, and Chick-fil-A, which disclosed that more than 13,000 customers may have been affected by credential-stuffing attacks against its website and mobile app. Attackers used usernames and passwords obtained from an external source to gain access to some loyalty accounts. These attacks may not be connected but the randomness, inventiveness, and diversity of the attacks, but is cause for concern.

Attack Patterns

Recent cyberattacks share three characteristics that should alert retail leaders.

1. Attackers are exploiting complexity: With increasing dependence on external platforms, contractors and specialist technology providers, those relationships can extend the attack surface beyond the organization’s direct control.
2. Consequences are becoming harder to separate from business operations: The French attacks affected food preservation, Fairlife’s incident interrupted production, Ahold Delhaize’s systems were taken offline, while TFG London’s response restricted online orders. Cybersecurity is now directly connected to availability, stock, fulfilment, and customer experience.
3. The cost extends beyond the initial breach: Retailers must investigate, restore systems, communicate with customers, assess legal obligations, and rebuild confidence. They may also face lost sales, spoiled inventory, operational delays and insurance disputes.

Action Plans

The immediate priority for retailers is to understand where critical systems depend on technology that is outdated, remotely accessible, or managed by third parties. Just ask Danfoss! For grocery retailers, that means reviewing refrigeration, temperature monitoring, warehouse controls, logistics systems, and other operational technology alongside traditional IT security. Remote access should be restricted to authorized users, protected by strong authentication and monitored for unusual activity, while unsupported equipment needs replacement or isolation.

Fashion and general merchandise retailers should review employee access, third-party marketing platforms, customer notification systems and ecommerce integration. Multifactor authentication, robust identity verification and least-privilege access can reduce the risk of compromised credentials opening the door to wider systems.

And all retailers need robust incident response plans that cover the practical consequences of a cyberattack. Can stores operate if online ordering is suspended? Can food temperatures be monitored safely if remote controls are disconnected? Can staff communicate with customers without relying on a compromised platform?

The complexity of guarding from cyberattacks is only going to get greater as AI enters more systems and hackers get smarter, more inventive and more attuned to the practical and reputational damage they can wreak.