Retail Breaches Spread as OT Systems Come Under Attack

Assured Intelligence investigates a series of security alerts across Europe, including major disruption for French supermarkets

These are nervous times to be a retail CISO. Last week we reported on a potentially significant data breach at ASOS, after hackers hijacked a customer notification system to publicise their raid.

Now the floodgates appear to have opened, with reports emerging of several UK and European retailers investigating incidents. By far the worst is a coordinated attack on hundreds of French supermarkets via their refrigeration controllers.

What happened in France?

The attacks in France appear to have happened overnight on the evening of October 11. Hackers were reportedly able to raise the temperature of refrigerators to 50 degrees Celsius by triggering an automatic defrosting system, causing fires at some stores and spoiling food. Affected retailers include Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U, with French minister Roland Lescure telling parliament that as many as 700 sites were hit.

“Our teams are fully mobilised” Dominique Schelcher

“I can confirm that, since last night, a cyber-attack has been affecting the refrigeration systems in several stores within our @CooperativeU network. Our teams are fully mobilised, working alongside refrigeration specialists to restore the situation as quickly as possible,” said Coopérative U president, Dominique Schelcher on October 12.

A security bulletin from CERT-FR published on October 12 lays the blame on supervisory monitoring and control systems: Copeland xweb, Danfoss AK-SC and AK-SM series, and Dixell xweb. It urges all customers to remove them from the public-facing internet and check for compromise.

It’s unclear exactly how the threat actors compromised these devices, although CISA warned in May and August 2025 of flaws in Danfoss AK-SM and Claroty has published a writeup of what exploitation might look like. A VikingCloud report published today reveals that 82% security leaders at multi-location brands in the US and Europe are seeing attacks becoming “more frequent or more severe”. Half (48%) claim they can’t see what’s happening at all locations in real time.

The fallout continues

It also remains unclear who is responsible for the attacks. No cybercrime group has yet come forward, which could indicate state-backed sabotage. SentinelOne research lead, Tom Hegel, claims the firm saw a similar campaign target US military commissaries in August, when freezers on several bases failed.

“A similar attack targeted US military commissaries” Tom Hegel

The cost in lost sales, incident response, and write-off of perishable stock could be significant. Some reports are citing figures of “tens of millions of euros” lost nationwide in a single day. The fallout will continue as long as refrigeration units are out of action and cannot be restocked.

Other noteworthy incidents

Reports are also emerging of incidents at the following retailers:

Ahold Delhaize:  A confirmed “cybersecurity issue” at the Netherlands-based multinational, with some systems taken offline as a precaution. The retailer claims stores remain open. However, reports claim websites for its Stop & Shop, Giant, Hannaford and Food Lion chains in the US displayed notices saying “site temporarily down”, while grocery deliveries were interrupted.

TFG London: The parent company of Phase Eight, Hobbs, and Whistles has confirmed it identified a “cybersecurity incident” on October 11 and activated its incident response and business continuity plans. Stores remain open, but some IT systems are unavailable.

H&M: Fashion retailer reportedly says it is investigating claims by ShinyHunters that it was compromised by the group. “We are currently investigating these claims to assess their validity and so far we have no indication that our data environment has been compromised,” notes a statement. The ICO has not yet been informed.

How cyber insurance can help

For retail bosses, cyber insurance represents an increasingly important part of enterprise risk management. All cyber policies would cover the privacy liability, extortion, incident response and regulatory defence costs that ASOS may incur following its breach.

“There may be a gap in cover for an attack that causes property damage or, more specifically, food spoilage.” Caspar Rogers

However, when it comes to the French supermarket incidents, Assured senior cyber broker Caspar Rogers warns of exclusions in cyber and property policies.

“There is a property damage exclusion in cyber policies and a malicious cyber exclusion in property policies, which means there may be a gap in cover for a malicious cyber-attack that causes property damage or, more specifically, spoilage of food,” he explains.

Retailers should therefore look for cyber insurance policies that cover spoilage. “This covers you for the value of the products that have been spoilt, as well as the loss of margin you would’ve made if you were able to sell the products,” Rogers continues.

“It’s also worth considering additional increased costs of working which go above the standard increased costs of working. This allows you to spend a bit more freely without worrying about the spend mitigating the business interruption loss proportionally. In France, extra costs could include emergency cold storage, disposal of food and recovery.”

Rogers also urges retailers to be on the lookout for narrow definitions of “computer systems” in their cyber insurance policies, to ensure they are affirmatively covering IoT devices like remote-controlled fridges. And to make sure that policies are written on a franchise basis so that once the waiting period has elapsed, business interruption cover is retrospectively applied from the moment the incident began.