Grocers have slim margins, perishable goods and an important social role, making them attractive targets for hackers.

By Maddie Parker, Jenny Che and Sabah Meddings When Jérémy Béziaud arrived last Monday at the Intermarché supermarket he manages in France’s Normandy region, he found freezers heating at 40C and a cold room ventilator for fish that had risen to 70C.

Monitoring teams had alerted Béziaud to temperature irregularities in the refrigeration system earlier that morning. But what he initially assumed to be an isolated issue at his store in Saint-Symphorien-le-Valois turned out to be part of a major cyberattack that had been launched on fridges and freezers across hundreds of French supermarkets. Even though his equipment was running again later that day, Béziaud had to dispose of €3,000 ($3,370) worth of products.

“I threw out all the fresh food,” he said. “I didn’t want to take any risks since the cold chain had been broken.”It will take nearly a week to replenish the stock that has been lost, but customers have been supportive, Béziaud said. “They understand how serious the situation is.”No group has publicly claimed responsibility for the hack.

The disruption in France, which affected 700 stores, including those from the Intermarché, Coopérative U and Carrefour SA chains, is the latest in a series of cyberattacks on retailers. Last year, hackers targeted UK supermarket the Co-op’s operations, affecting deliveries, leaving some stores short of fresh food, and causing the grocer a sales hit of more than £200 million ($267 million). Marks & Spencer Group Plc was also struck by a major cyberattack in 2025, disrupting online services for four months and contributing to an estimated £300 million fall in operating profit.

Experts said that the incidents expose how vulnerable food retailers are to cyberattacks. Grocers often run on thin margins with tightly-calibrated supply chains and large volumes of perishable products, which can be spoiled by even relatively short disruptions. They are also a vital element of countries’ food security, making them an attractive target for attackers who want to create chaos.

Hackers are “targeting retail because they’re weak and it can have a massive impact on society,” said Harjinder Singh Lallie, reader in cybersecurity at the University of Warwick. “We’ve got this kind of snowball effect — as other cyberattackers see that this is an area that is very underprepared, more of them are targeting the retail sector.”A spokesperson from Groupement Mousquetaires, which owns Intermarché, said 300 of its stores were attacked. Carrefour said 80 supermarkets were impacted.

The attacks on M&S and Co-op in the UK were reportedly attempts to extort money from the companies, and investigations into both centered on groups known for using “social engineering,” in which intruders dupe people into giving up their credentials or providing access in some other way.

The hacks in France were executed through centralized fridge controllers, connected to the internet, which allow contractors to remotely monitor temperatures. Attackers gained access to some of those systems and manipulated their settings, triggering prolonged defrost cycles that caused refrigerators and freezers to heat up. Danfoss, one of the manufacturers whose equipment was affected, said most of the compromised devices were obsolete models that no longer received software or security updates.

The need to manage stock and meet food safety standards mean that retailers have invested in the internet of things, connecting their infrastructure to the internet to allow for real-time monitoring and data collection. However, these devices create vulnerabilities over time, as they age, and as their owners neglect to keep up with evolving cyber threats.

Bill Moore, chief executive officer of cybersecurity firm Xona Systems, said refrigeration and heating, ventilation and air-conditioning systems in retail stores were often 10 to 15 years old, installed when cyber threats were less prominent. Retailers, he said, had fallen behind manufacturers in recognizing the risks posed by connected equipment. “It has not been a top consideration for many of them,” Moore said .

Traditionally, the systems that control physical equipment such as machinery and refrigerators were separated from corporate IT networks, which helped limit the risk of an intrusion spreading from one environment to another. But remote maintenance, software updates and other connections can expose equipment to the internet, potentially creating opportunities for attackers.

“Retailers depend on vast networks of interconnected technologies to keep their businesses running,” said Luca Berni, threat intelligence director at Palo Alto Networks Unit 42 in Paris. “As retailers expand their digital operations, maintaining consistent security across every location, platform and partner becomes increasingly difficult.”The disruption to business that these kinds of attacks can cause for grocers is severe. Food perishes quickly, and defrosting freezers can cause a lot of damage.

“There would have been a lot of water on the floor,” Alan Foster, associate professor in the Heating and Cooling Group at London South Bank University. “Stuff would have gone really gooey and disgusting, so removing it wouldn’t have been simple.”The clean-up and restart operations are also time consuming. Before restarting the fridges, supermarkets would likely need safety checks and, in some cases, refrigeration engineers to assess the damage. Some cabinets could be back in operation the same day — as happened at Béziaud’s store — while more badly damaged equipment may need replacing.

Mousquetaires’ spokesperson said that their refrigeration supplier is responsible for cleaning up its systems. Coop U and Carrefour did not respond to requests for comment.

Retailers’ low margins mean that they have often not prioritized investing in securing their systems, experts said. “They don’t print money as a sector, which means they’ve got to be very lean in how they operate, which means they are more exposed to getting hit,” Laura Duncan, cyber security partner, leading retail and consumer at PwC in London, said. Duncan said retailers were increasingly looking at how to recover from a hack, including ensuring their business can run offline if required: “Could you do things manually with pen and paper?” she said.

Security experts warn that the threat could become harder to contain as attackers make greater use of artificial intelligence, which may help criminals identify weaknesses, develop convincing phishing messages or accelerate parts of an intrusion.

Cybercriminals frequently reuse tactics that have proved successful, raising the risk that vulnerabilities exposed by one attack are subsequently targeted by others. The attacks should be a wake-up call for retailers and governments, experts said. Grocers are “now clearly kind of open targets,” the University of Warwick’s Singh Lallie said. “They’ve been announced out there in the cyber criminal fraternity that these are easy target.”