Cyberattacks against supermarkets: Products, sales and orders in the firing line

The fact that several cyberattacks against European supermarkets occurred at the same time highlights the importance of strengthening their security in the face of an increasingly challenging threat landscape

When thinking back to the 2020 pandemic, it is impossible not to recall how toilet paper vanished from supermarket shelves within hours of the lockdown being announced. Something similar happened during the major Iberian power cut of 2025, when thousands of consumers flocked to supermarkets to stock up on food. These extraordinary events clearly illustrate the critical role that hypermarkets and supermarkets play in the functioning of our society and in our ability to meet one of our most important basic needs: feeding ourselves.

For this reason, cyberattacks against supermarkets and hypermarkets can pose a problem not only for companies in the sector, but also for society as a whole. Undoubtedly, shortages of basic foodstuffs directly affect the day-to-day lives of businesses and citizens. Hence, recent news reports of several cyberattacks against supermarkets in France, Belgium and the Netherlands have captured the attention of both organisations in the retail sector and the general public.

Below, we will outline the key aspects of the recent cyberattacks against supermarkets and address the critical elements relating to cybersecurity in the food sector.

Fresh produce at 50º: Cyberattacks on supermarkets put their stock at risk

In the early hours of 11–12 October 2026, the temperature in the refrigeration systems of hundreds of French supermarkets rose to 50º for several hours.

This was neither an accident nor a coincidence, but a massive cyberattack against the systems of several French supermarket chains.

The malicious actors behind the cyberattack managed to exploit a vulnerability in the software used to remotely control the refrigeration systems, which had been developed by a Danish company.

This enabled them to trigger a defrost cycle and set the supermarket equipment to 50º. As the cyberattack took place in the early hours of the morning, the companies were unaware of what had happened until early in the morning, when delivery drivers began arriving at the stores.

This naturally affected the fresh and frozen products in the stores. Consequently, the supermarkets have been forced to dispose of thousands upon thousands of products, given that selling them could pose a risk to public health.

Although the investigation is still at an early stage and the affected companies have not yet been able to assess the full extent of the damage, the sector is already anticipating that businesses will suffer losses amounting to tens of millions of euros.

As if this scenario were not worrying enough, during the night of Monday 12 October to Tuesday 13 October – that is, one day after the first cyberattacks against supermarkets – further incidents were detected affecting equipment from another supplier. That company has identified the cause as the exploitation of a vulnerability in discontinued controllers that had reached the end of their life cycle.

These cyberattacks against supermarkets demonstrate that any device connected to the internet increases companies’ cyber exposure and compels them to have a cybersecurity strategy commensurate with their level of exposure to threats.

Attack surface, economic pressure and competitiveness

Economic pressure and competitiveness in the retail sector are driving supermarket chains to increasingly integrate electronic systems to optimise their operations, which results in an increase in the attack surface.

It is therefore now common practice to use software to:

• Manage the temperature of refrigerators centrally to ensure product quality.
• Manage the products sold in each shop.
• Carry out the logistical management of the outlets.
• Assess the production sectors in which they are going to invest.

Recently, economic pressure has been leading supermarket chains to take all of the above factors into account in order to adjust prices at a speed that was previously unthinkable.

Part of this process relies on the integration of price-updating measures that are faster than traditional price tags: electronic price tags. This is a highly complex issue because electronic price tags can not only curb demand but, if they involve selling at below-cost prices, can lead to a direct financial loss on every sale.

Disrupting online orders: a way of undermining companies’ revenue

If the large-scale attack on supermarkets run by major French companies were not a loud enough wake-up call, it has coincided with other cyberattacks on European supermarkets.

Consequently, the website and mobile apps of one of the Netherlands’ leading supermarket chains, were taken offline in the early hours of Sunday morning, and the company reported that it was likely experiencing a cybersecurity incident.

As a result, the company’s ability to process online orders and deliver them to its customers was affected – a channel of business that accounts for 10 per cent of its sales. Furthermore, Dutch media have reported that several of the company’s distribution centres have been paralysed as a result of the incident.

In fact, the Dutch media also point to an increase in orders placed with rival companies. This represents a significant loss of revenue.

Similarly, another Belgian supermarket chain, which is a subsidiary of the same conglomerate as the Dutch one, has also experienced a disruption to its order management and customer service operations.

Consequently, the financial consequences of this security incident could also run into millions.

Disrupting order processing to cause shortages in supermarkets

Beyond these recent incidents, the truth is that cyberattacks against supermarkets are nothing new.

For example, in 2024, several industry giants experienced security incidents that directly affected the day-to-day running of their outlets. In one such case, the supply of goods such as frozen foods, fruit and fresh produce was temporarily disrupted, leading to shortages in shops.

The supply chain: the Achilles’ heel of cybersecurity for some organisations

«This incident highlights the importance of resilience throughout the supply chain», was the warning issued by Christel Delberghe, Chief Executive of Eurocommerce, in the wake of the large-scale cyberattack suffered by hundreds of French supermarkets. The chief executive of this European retail association highlighted a critical issue for the cybersecurity of all types of companies: the protection of the supply chain.

As noted earlier, the source of the large-scale attack that caused the temperature of the refrigeration systems in hundreds of supermarkets to rise was, according to initial investigations, the exploitation of a vulnerability in the software used to control them remotely.

This case is by no means an exception. Supply chain attacks have been a constant feature for years. Many malicious actors target companies and public authorities by exploiting vulnerabilities in the third-party software and hardware they use to operate.

In fact, large companies – such as supermarket chains – work with multiple software and hardware suppliers. It is therefore essential that their security strategies cover all technological assets, whether they have been developed in-house or by third parties. Otherwise, organisations leave themselves vulnerable to high-impact cyberattacks against supermarkets.

Agile and comprehensive vulnerability management is more critical than ever

As well as highlighting the supply chain, the large-scale attack on French supermarkets underscores the central role that vulnerability management plays in corporate security. Why?

In the first wave of incidents, the malicious actors behind them exploited a vulnerability that had been discovered months earlier and had already been patched by the software developer. Updating the software would therefore have mitigated the vulnerability.

However, the systems attacked in France were running outdated versions of the software, thereby opening the door to the malicious actors behind the cyberattacks on supermarkets.

Meanwhile, in the second wave of cyberattacks on supermarkets, a vulnerability was exploited that affected obsolete systems or those at the end of their lifecycle.

This demonstrates, once again, the importance of companies implementing comprehensive vulnerability management that monitors all weaknesses detected in their IT infrastructure, prevents the use of equipment that is no longer supported, and prioritises the remediation of vulnerabilities based on the likelihood of them being exploited and their potential business impact.

In fact, vulnerability management is now more crucial than ever. Why? Artificial Intelligence is enhancing the ability of hostile actors to track down and detect vulnerabilities more quickly, and to reduce the time it takes from the moment a vulnerability is found until a proof-of-concept is developed to successfully exploit it.

If an organisation fails to ensure that security updates released by its suppliers are implemented as quickly as possible, it risks being successfully attacked and suffering incidents as serious as those we have outlined in this article.

In cybersecurity, every minute counts. And in the age of AI, even more so.

The food sector is a critical sector in the EU according to NIS2

Beyond the serious consequences that cyberattacks on supermarkets can have for companies, we must not lose sight of the impact they can have on society as a whole and the economy.

If a security incident affects the supply of essential goods such as food, it can cause significant harm to thousands of people.

It should therefore come as no surprise that the food sector is considered a critical sector within the European Union.

This is set out in the NIS2 Directive, which aims to ensure the resilience of organisations operating in critical sectors and to safeguard their business continuity.

Although this regulation has not yet been transposed into Spanish law – despite the deadline for doing so having passed – it is likely that a bill to this effect will be introduced after the elections.

Which measures included in the NIS2 Directive may be essential when it comes to preventing, detecting and responding to cyberattacks against supermarkets? Companies falling within the scope of this regulation must:

• Carry out a risk analysis.
• Be prepared to manage security incidents and ensure that they resolve those affecting their own systems and that their suppliers manage those affecting theirs.
• Have adequate mechanisms in place to ensure business continuity.
• Increase the level of protection for their supply chain.
• Implement effective vulnerability management.
• Have access control policies in place for their systems.

Therefore, once the directive has been transposed, these measures will not only be recommended to prevent and manage cyberattacks against supermarkets, but will also be legally binding.

Threat Hunting and incident response to tackle cyberattacks against supermarkets

Whilst vulnerability management is essential for preventing the exploitation of weaknesses in IT infrastructure, there are other key cybersecurity services for detecting cyberattacks against supermarkets and minimising their impact:

• Threat Hunting. Threat hunters work on the basis of compromise hypotheses, enabling them to detect malicious activity before security incidents occur. This makes it possible to intervene at an early stage of an attack.
• Incident response. As demonstrated by the cyberattacks on supermarkets we have discussed, responding swiftly to incidents can be key to limiting the scope of the breach, expelling hostile actors as quickly as possible, restoring normal operations rapidly and safeguarding business continuity. A proactive incident response enables organisations to have robust, tested response plans in place and teams that can begin working from the very first minute to orchestrate an effective response.

In short, the recent cyberattacks against supermarkets demonstrate that:

• This sector has a robust technological infrastructure that supports essential processes such as order management, online sales and product preservation.This technological infrastructure increases its cyber exposure.
• Cybersecurity must be a central element in the business strategies of hypermarket and supermarket chains.
• Cyberattacks against supermarkets can have serious repercussions not only for the companies themselves, but also for the general public and the wider economy.
• Ensuring business continuity for supermarket chains and preventing shortages of essential goods is of the utmost importance. This is why the food sector is considered critical, just like healthcare, finance or transport.