Understand the growing cyber risks within connected store infrastructure and how this can affect resilience in the food system.
A large-scale cyberattack, said to be the first of its kind, has disrupted refrigeration systems across several major French grocery retailers, causing food spoilage, store disruption and significant financial losses. Intermarché has reported the attack affected 300 stores, over 12% of its total store network in France.
The attack has seen refrigerator systems reach 50 degrees Celsius, spoiling food and causing in-store fires.
The affected retailers
The full scale of the cyberattack on Danfoss refrigeration systems is yet to be determined. It is believed to have affected Carrefour, Casino Group, Les Mousquetaires, Cooperative U and potentially Leclerc. Monoprix reported that 5% of its store network was affected, while Carrefour claims 80 supermarkets were impacted.
The cyberattacks' impact potentially extends beyond France, with other European supermarket chains in Belgium, Germany, Poland, Portugal, and Spain being affected.
Other recent incidents show that cyber risk is affecting multiple parts of France’s grocery ecosystem. A cyberattack on Carrefour’s delivery technology provider, Shipup, saw customer data linked to the service stolen, increasing the risk of phishing. Separately, Biocoop’s professional extranet was targeted, with a hacker claiming to have stolen nearly 2.8 GB of internal data. Together, these cases highlight how vulnerabilities can extend beyond retailers’ core systems to third-party partners and business platforms.
The potential damage
The cyberattacks’ impact in France was immediate. Thierry Cotillard, the president of Les Mousquetaires, claimed, ‘The attack caused all our refrigerated display cases to defrost and raise their temperatures to 50 degrees Celsius. So, it's safe to say it's a disaster. This has never been seen before, and it has never been seen on this scale’. An investigation is underway to measure the full extent of losses and damages amongst the French retailers affected by the refrigeration system hacks.
The main damage areas for retailers include:
Product loss and food safety: attacks on refrigeration, temperature monitoring or warehouse systems can spoil stock, trigger product withdrawals and create fire risks.
Store and supply-chain disruption: compromised ordering, payment, distribution or inventory systems can interrupt deliveries, reduce product availability and force stores to operate manually or temporarily close.
Direct financial costs: retailers face lost sales, wasted stock, system recovery costs, specialist support, customer compensation and higher insurance premiums.
Customer data exposure: stolen personal or payment data can increase phishing and fraud risks, while creating legal and regulatory consequences for the retailer.
Third-party vulnerability: retailers can be affected through technology providers, logistics partners, suppliers and other connected platforms, even when their own systems are not directly breached.
Reputational damage: customers may lose confidence in a retailer’s ability to protect their data, maintain availability and operate stores safely.
Pressure on shoppers and suppliers: disruption can lead to gaps on shelves, reduced choice and potentially higher prices, while suppliers may face cancelled orders, delayed payments or additional compliance requirements.
Long-term investment needs: retailers may need to replace equipment, separate critical systems, strengthen access controls and build manual contingency processes.
Why does it matter?
Cyberattacks create great vulnerability for retailers and suppliers and are becoming an operational risk, from stealing personal data to destroying in-store stock. Thierry Cotillard claims the retailer is under attack three to four times a day. This exposes retailers to major resilience issues, bringing extreme pressure to the total supply chain.
The cost of damage will bring significant consequences to retailers and could filter down to the shopper. Shoppers will be impacted by a loss of product availability. Retailers will have to measure the scale of loss in terms of value and total impact from the end-to-end supply chain.
Overall, the attack highlights how cyber threats are evolving from an IT risk to an operational one. By disrupting refrigeration systems across multiple retailers, it exposed the vulnerability of connected store infrastructure and the systemic risks associated with shared technology providers. As grocery operations become increasingly digitised, retailers will need to strengthen operational technology security and supplier oversight, while treating cyber resilience as a critical pillar of business continuity and food supply resilience.
This incident reinforces why IGD identified cybersecurity as one of its key retail trends for 2026. In our Global retail trends 2026 report, we predicted that as retailers accelerate investment in AI, automation, connected devices and integrated store systems, cybersecurity would move from a siloed IT function to a board-level strategic priority. We also highlighted that as digital touchpoints multiply, cyber risks increase, and that retailers must balance innovation with the need to secure resilient infrastructure.
The recent attack on French retailers is a stark reminder of why this matters. Reports suggest the attack exploited vulnerabilities in connected refrigeration control systems, many of which used outdated software or were exposed to the public internet.
As stores become increasingly connected through electronic shelf labels, smart refrigeration, IoT sensors, robotics, cameras and AI-powered systems, the commercial benefits are clear: better availability, lower costs, improved productivity and a better shopper experience. But every connected device also represents a potential vulnerability point if not properly secured.
Cyberattacks should not slow digital transformation
Attacks like these highlight the need to accelerate, rather than slow, investment in modern, secure infrastructure. The issue is often not the latest technology itself, but legacy systems, outdated firmware, poor visibility of connected devices and insufficient cybersecurity governance. The lesson is not to stop connecting stores, but to ensure resilience is designed into them from the outset.
In our trends report, we argued that resilience is becoming the new baseline for retail success and that retailers will increasingly be judged on their ability to maintain safe, resilient operations when systems come under attack. As connected stores evolve towards more autonomous and ultimately "sentient" operating models, cybersecurity can no longer be treated as just an IT issue. A cyber incident can quickly impact operations, food safety, waste, customer trust and brand reputation.
Ultimately, the future store will only be as strong as the resilience built into the systems that power it. Connected retail and cyber resilience must advance together. Innovation without security creates risk, but innovation with resilience creates competitive advantage.