Ask any grocery store manager what they dread, and refrigeration failure will be near the top of the list. It will rarely happen at a convenient time. It will happen overnight, over a holiday weekend, or during a heatwave, when the store is closed or running on a skeleton crew.
This autumn, that familiar fear took a new form. In the early hours of October 12, attackers got into the refrigeration controllers of around 700 French supermarkets and switched cabinets to defrost. Intermarché’s CEO put the cost at tens of millions of euros in a single day. On November 2 it happened again: around midnight freezers began defrosting in dozens of stores in Belgium and Luxembourg, and in shops in Sweden, Ireland, the Netherlands, Estonia and Finland.
But one store was able to tell a different story. In Estonia, the problem was caught and handled in about ten minutes. Freezer temperatures rose by only two or three degrees, and not a single product was thrown away.
Fridges will fail. What matters is how fast you respond.
It’s tempting to file such attacks as cybersecurity incidents and leave them to IT. That would miss half the lesson. This is as much a communications problem as a security issue.
Fridges fail all the time without any help from hackers. A compressor dies over a weekend, a door is left ajar, a unit trips in a heatwave. From the shop floor, a hacked freezer looks exactly like a broken freezer. The temperature climbs, and once a cabinet has been too warm for too long, food safety rules leave no choice. The stock goes in the bin.
The bill doesn’t stop with the loss of stock. There’s the disposal, the staff hours spent clearing and restocking, and the sales lost while cabinets sit empty. Shoppers who find the frozen aisle taped off just go somewhere else. After fridge failures during this summer’s heatwave, one German store manager said some customers stopped shopping there altogether, and the store lost around 10 percent of its sales.
Then there are the people. Retail frontline teams have some of the highest turnover of any sector, and many stores run on stretched shift schedules. An overnight emergency lands on whoever is on call (often a manager already working long weeks), and a morning spent binning stock is exactly the kind of draining, unplanned work that pushes good staff to leave.
The Estonian store didn’t have a better fridge. In fact, it was the last store in its chain still running the older control system. What it had was preparation and speed: its refrigeration partner spotted the attack quickly, and it was dealt with within ten minutes. In Belgium, the attack began around midnight, according to refrigeration firm Sabcobel, but some stores’ alarms only sounded hours later, around 3 or 4 a.m. In Stockholm, one store was hit at 2 a.m. and nobody noticed until 5.30. And an alarm only helps if it reaches someone who picks it up. As Mitel’s Critical Communications expert Eliza Zografova puts it:
“An alert nobody acknowledges is just a notification. A response starts when a person receives it, takes ownership and acts.”
An attack adds one more problem: scale. If a failed compressor affects one store, an attack hits dozens in the same hour, and one regional on-call manager can’t drive to 40 sites.
Three steps to keeping your supermarket out of the headlines
1. Control your architecture
Start with how the attackers got in. Many of the hacked controllers were older models, reachable from the internet so engineers could manage them remotely, and some no longer received security updates. Route all remote access through a secure, controlled channel. Then plan for the attack that gets through: add an independent temperature sensor, so your alarms keep sounding even if the controller itself is compromised.
Then make sure the alerts travel on a communications platform that keeps working when things go wrong. A hybrid cloud approach gives retailers the best of both: alarm handling that runs locally in each store, so alerts still reach staff if the internet link drops, with central management and visibility across the estate. Critical parts stay off the public internet, and you choose where your data lives.
2. Have the workflow ready before you need it
When a cabinet starts warming at 2 a.m., it’s too late to be working out what to do. The workflow should already exist: who gets the alarm first, who goes to the store, who calls the refrigeration contractor, when stock is moved or discarded, and when IT and security get involved.
This is where Mitel’s critical communications portfolio comes in. OpenScape Alarm Response (OScAR) connects directly to temperature sensors, so alarms go straight to the people who can act, wherever they are. When a temperature sensor crosses its threshold, OScAR automatically sends an alert to the first person on the store’s list, then escalates to the next if nobody acknowledges, until someone takes ownership. OScAR puts the alert straight onto the devices that store teams already carry, such as DECT/Wi-Fi handsets or mobile phones, and Mitel Critical Event Management (CEM) can send warnings more widely when many stores are affected at once. Mitel Workflow Studio lets you build and change these workflows without code, for example by alerting IT and security automatically when several stores alarm within minutes of each other.
Finally, treat the alert path as critical infrastructure. With Mitel Managed Services and Mitel Performance Analytics, the communications platform is monitored around the clock, so faults are caught and fixed before they can block an alarm.
3. Learn from every incident
Every alert OScAR handles is logged: when it was raised, who was notified, when it escalated, who acknowledged it. That record is evidence for food safety inspectors and insurers. Mitel CEM adds the next layer with after-action analytics, so you can review how an incident unfolded and improve your response for the next one. Across a whole estate, it shows which stores respond fastest, where shift schedules leave gaps, and which equipment fails most often. After an attack, the timeline of which stores alarmed, and when, gives your security team a head start in understanding what happened and how to stop it happening again.
Fast response, every time
The retailers who get through the next attack with full shelves will be the ones where someone picks up the alert within ten minutes.
Want to see how automated escalation works in a retail store? Explore our retail solutions or talk to our team about building a response that works at 2 a.m.
