Hacked: the cybersecurity blind spot putting UK supermarkets at risk

The Monday morning Julien Freret will never forget began at 5am on 12 October with an unexpected phone call from a baker. “I think you need to come,” the baker said. “There’s a big, big, big problem with the refrigeration.”

By the time Freret arrived at the Intermarché supermarket he had managed for two years in the historic town of La Haye in Normandy, France, the fridges had reached temperatures of around 50°C. And they were still rising.

“That was when panic set in,” Freret recounted to Business Insider. “We thought: this can’t be possible.”

They restarted the fridges and freezers. Then the motors were shut down. Technicians were called. But it was too late.

A skip-and-a-half’s worth of food – valued at about £84,000 – was ruined and had to be thrown away. In a message to customers, Freret explained how the store had suffered a “total loss of fresh and frozen food”. But the refrigeration systems hadn’t gone haywire or failed, they’d been taken over.

Exploiting a security flaw in the fridges’ internet-connected controllers, hackers had hijacked them, forcing the units into a continuous defrost cycle that meant they kept heating until their fans melted.

This wasn’t just happening in La Haye. French authorities would later reveal that around 700 supermarkets – including stores owned by Carrefour, Intermarché, Netto, Coopérative U and Monoprix – the length and breadth of the country had been struck by the cyberattack. Some suffered fires as a result. Losses were estimated to be in the tens of millions of euros.

The incident has exposed an uncomfortable truth: supermarkets have hugely increased the number of connected electronic devices within their stores – from fridges and electronic shelf labels (ESLs) to digital advertising screens. This operational technology, or OT, is too often outsourced and unaudited by retailers.

As Coopérative U CEO Dominique Schelcher put it in a statement in the wake of the attack, the hack was “unprecedented, extremely serious and unacceptable”. But not – it turns out – all that difficult.

Having steel-plated the cyber defences surrounding customer data and payments and wargamed against criminals demanding ransoms, retailers are proving far less prepared to deal with hackers whose primary goal seems to be to simply melt all the ice cream.

Cybersecurity priorities

Supermarket security teams “naturally prioritise” IT systems, explains Dr Asma Adnane, senior lecturer in computer science at Loughborough University, because they “hold customer data, payment information or financial records” and “because a breach there has clear regulatory and reputational consequences”.

They’re not always successful, of course. The cyberattack on M&S that started at Easter 2025 had direct costs of £136m covering immediate incident response and recovery, as well as specialist legal and professional services support. There was also a huge hit to sales as online operations were paused as the retailer worked to extract the intruders.

An attack on the Co-op, which started just days after the M&S hack, wiped £285m off its sales as the retailer was forced to shut down its systems in response.

By comparison, “operational devices can be seen as dull, background infrastructure”, Adnane says, and so “attract less attention despite being critical to day-to-day operations”.

“OT has been overlooked for years,” says Charles Radclyffe, CEO at EA Global AI. “What’s remarkable is not the hack itself, but that a system capable of destroying an entire store’s chilled stock often sits outside the board’s cyber risk register because it’s classified as facilities rather than IT.”

OT is everywhere in a store. It’s in the heating, ventilation and air conditioning systems that now intelligently work out the optimum temperature and airflow based on weather and footfall. It’s in the digital screens displaying retail media adverts – uploaded remotely and changing based on the time of day and current promotional campaign.

It’s in the ESLs that show real-time product prices, eliminating the productivity drain of placing paper labels. It’s in the fridges and freezers that can self-regulate to run at maximum efficiency and on which maintenance checks can be made remotely.

Every one of these devices “is now effectively a small computer on the network”, says Radclyffe.

“Most retailers know their email security posture and payment compliance in detail,” he says. “Far fewer can tell you which refrigeration controllers, shelf-label systems or digital signage screens are internet-facing, what software they’re running or who has access.”

The French hackers had easy work of it. The fridges’ built-in computers, known as controllers, are used by engineers to check temperatures and tweak settings. Their web login pages were found easily by hackers on the open internet, rather than being hidden and reachable only via a private, protected connection.

Initially, it was thought the hackers had used an exploit – the username ‘admin’ and a hidden ‘password of the day’ function that was that day’s date – published earlier this year by cybersecurity firm Claroty to gain access.

But speaking to the French Senate last month, Vincent Strubel, head of France’s cybersecurity agency ANSSI, said: “These vulnerabilities were not exploited.

“These were basic security flaws, starting with the direct exposure of refrigeration equipment to the internet and its administration without any particular security measures, weak passwords, that sort of thing,” he explained.

Once in, hackers had full control of the fridges’ operation, meaning they could instigate a forced, repeat defrost cycle with the food still inside and no staff around to notice it.

ESLs have hacking potential, too. At a cybersecurity conference this summer in Heidelberg, Germany, a trio of so-called whitehat hackers – who work to warn of system vulnerabilities before they are exploited – presented how they were able to hack the ESLs of two major vendors used by retailers across Europe.

“We found numerous weaknesses in the products we examined and were able to take control of the ESLs and their management software faster than we had expected,” researcher Marius Karstedt told The Grocer. “The possibilities were endless.”

Other OT has also been successfully hacked over the past year. As hacker BobDaHacker wrote in his account of how he commandeered the controls of robots from one of China’s biggest robotics manufacturers, there were countless “possibilities for chaos”, from cancelling all robot tasks during rush hour to having the bots “continuously circle the dining room playing music”.

OT isn’t inherently insecure. The technology can be just as hardened against hackers as anything else. The reason they are such a fertile attack surface is not the technology itself, but how organisations treat it.

The incident in France – considered in some reports to be the first cyberattack to have a real-world effect on a nation’s food supply chain – exposes “a persistent gap between known cybersecurity risks and the level of investment devoted to mitigating them”, according to Adnane. “This is a governance issue, not only a technical one.”

New way of thinking required

Until recently, the connected devices that fill stores “were not thought of as IT at all” says Kumar Sokka, CEO of Acre Security. “They were plant: you installed them, they ran for a decade, nobody touched them. Now everyone is a controller on the network and the mindset hasn’t caught up.

“In most estates no one holds a full list of what is connected and reachable,” he adds.

The hackers might. The “front doors” to the control systems of more than 800 UK retailer fridges are “reachable by anyone on the internet who knows where to look”, analysis by UK Cyber Defence shared with The Grocer found.

While having the web login pages discoverable on the internet doesn’t automatically give hackers access to the control system, it does expose them to “whoever finds the next flaw or guesses a weak password”, says Peter Bassill, UK Cyber Defence founder & chief information security officer. It’s not a “broken lock” but it is like “having your front door on the street”.

Many supermarkets would have assumed their device provider or third-party contractor would be looking after security. They now need to be firmer in demanding an inventory of these assets, regular patching to be written into contracts and tighter controls regarding remote access.

“The reassuring part is that this is housekeeping, not rocket science,” Bassill says. “Do that and you’ve shut the door the French attackers walked through.”

The motives of the French fridge hackers remain unknown. No demands were made. No ransom set. And no group has claimed responsibility.

“There’s still a large undercurrent of the hacker movement that is doing it just for the fun of it,” Bassill adds.

That adds complexity to dealing with such hacks.

“A hacker who isn’t demanding a ransom can be more concerning than one who is,” says Radclyffe. “Ransomware is a business model and business models negotiate. An attacker with no demands, no claim of responsibility and no obvious motive gives defenders nothing to work with. You don’t know whether it’s vandalism, espionage, disruption or a rehearsal for something bigger.”

The latest developments in AI add more powder to the keg. Earlier this month, AI company Anthropic revealed its experiments suggest “small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things devices, like smart ovens and off-brand Android TV boxes”. Retailer OT would be ripe for such models.

Even before then, AI can “basically do exactly the same as that mythical hoodie-wearing teenager in a bedroom: find the exploit, find the vulnerable systems, run the exploit against the vulnerable systems,” explains Bassill.

At the same time, AI can help retailers. Its use “cuts the other way”, says Sokka. It is “how you finally monitor an estate this size and flag the controller behaving oddly before it becomes a fire and a weekend of lost stock”.

The attacks in France have brought fresh attention to the devastation that overlooking OT security can cause the grocery sector.

“The images of empty shelves and wasted produce at French supermarkets are a stark reminder of how our digital connectivity can be used against us,” Jonathon Ellison, director for national resilience at the UK’s National Cyber Security Centre, tells The Grocer.

As a tired-eyed Freret said in a video message to customers that unforgettable Monday morning: “We never imagined we would see something like this. Here in our rural area, at our Intermarché”.

Unless supermarkets act on OT, something like this could happen anywhere.