What: A cyberattack on obsolete Danfoss refrigeration controllers overnight on 12 October spoiled stock across roughly 400 French supermarkets, as Asos, TFG London and Ahold Delhaize reported separate incidents within days.

Why it is important: The French attacks move cyber risk from data loss to physical disruption, while Asos and H&M show attackers continue to reach retailers through employees and third-party platforms.

Overnight on 12 October, attackers manipulated refrigeration controls in French supermarkets operated by Intermarché, Carrefour, Monoprix, E.Leclerc and Coopérative U, forcing fridges and freezers to heat up and stay hot. Food estimated to be worth millions of dollars was spoiled, equipment was damaged and many stores closed temporarily. Figures from individual chains suggest about 400 of France's 15,000 supermarkets were affected, including more than 100 Coopérative U stores and 180 Intermarché and Netto stores. No group has claimed responsibility.

The affected systems used technology from Danfoss, which said many units were obsolete, no longer received security updates or ran outdated firmware. Researchers at Claroty had published flaws in its AK-SM 800A controller in August. Le Monde also reported smaller attacks on Dixell equipment.

Asos confirmed that an attacker impersonated a trusted contact to obtain an employee's credentials and access customer data on third-party platforms, while TFG London, owner of Whistles, Hobbs and Phase Eight, suspended online orders after an attack. Ahold Delhaize took systems offline across five US banners and European services including Albert Heijn.

The author urges retailers to audit outdated, remotely accessible or third-party-managed systems, enforce multifactor authentication and prepare incident plans that keep stores operating.

IADS Notes: The Asos breach was traced to an attacker who impersonated a trusted contact to obtain an employee's credentials and then accessed customer names and contact details held on third-party platforms (Reuters, October 2026). Within a week, H&M Group was investigating claims of an attack by Shinyhunters, a group specialising in social engineering, AI-powered voice phishing and cloud misconfigurations, which sources linked to the Asos incident (Retail Week, October 2026). Exposure through suppliers extends beyond the first tier: a breach at a global logistics provider showed that most vendor risk programmes stop at direct suppliers, with dependency mapping, supplier isolation, continuity plans and tabletop exercises recommended in response (RH-ISAC, August 2026). The longer-term cost is visible at Marks and Spencer, which only forecast a return to profit growth after accelerating investment in technological resilience (Financial Times, May 2026), and at Co-op, whose chief executive is stepping down as the costs of its attack mount (Financial Times, March 2026).

What's behind the French supermarket cyberattacks?