From supermarkets to airports: Cyberattacks that disrupted real-world ops

From French supermarket refrigerators to Polish energy infra, recent cyberattacks have exposed how vulnerabilities in connected systems can disrupt operations, damage equipment, threaten supply chains

The cost of a cyberattack is not always found in a ransom demand or a stolen database. It can lie in food that must be thrown away, cars that cannot leave the production line, flights delayed by failing airport systems or energy equipment knocked offline. A series of attacks across countries has exposed the vulnerabilities hidden inside the systems businesses rely on every day.

 

From France's supermarket aisles to car plants, airports and energy networks, hackers have found ways to disrupt the systems businesses depend on to keep running. Here are some of the major cyberattacks that have caused similar disruption, hit businesses and supply chains, or exposed vulnerabilities in critical infrastructure.

 

France's supermarket refrigeration attack

A cyberattack on October 11-12 targeted refrigeration systems at French supermarket chains, including Intermarché, Netto, Coopérative U, Carrefour and Monoprix. Reuters reported that Intermarché alone had around 150 affected stores, while Coopérative U confirmed disruption at 80 outlets. Refrigeration temperatures reportedly reached 50 degrees Celsius at some locations, spoiling food and triggering fires.

 

The attack reportedly exploited weaknesses in refrigeration controllers made by Denmark's Danfoss. In August 2026, cybersecurity firm Claroty flagged vulnerabilities in the manufacturer's AK-SM 800A controller. Investigators have yet to establish whether those flaws were used in the supermarket attack.

 

Intermarché's chief executive put the losses across the industry at tens of millions of euros in a single day. France's National Cybersecurity Agency and the Paris prosecutor's office are investigating the incident. Who carried out the attack and what they aimed  to achieve remain unclear.

Minnesota's community water systems

More than 30 community water systems in Minnesota were targeted in a coordinated cyberattack on July 26-27, according to Minnesota IT Services. The state's cybersecurity teams worked with local, federal and private-sector partners to investigate and contain the activity.

 

Officials described the targets as operational technology, which controls physical processes rather than conventional office computing. The state advised operators to restrict unnecessary internet access to industrial controllers, strengthen passwords, enable multi-factor authentication where possible and separate operational networks from administrative systems.

 

The investigation did not attribute the activity to a specific actor. Officials said there were no active requests for residents to change their drinking water use.

Tata Electronics' data breach

Tata Electronics confirmed a cybersecurity incident after the extortion group World Leaks claimed to have stolen confidential files and released samples online. Recorded Future News reported that the material allegedly included specifications linked to Apple suppliers and manufacturing documents related to Tesla. The authenticity of the leaked files has not been independently verified.

 

The company said it had detected the breach weeks earlier and taken steps to address it. It added that operations across its businesses had not been affected. Tata Electronics did not disclose any financial losses arising from the incident.

 

While production continued uninterrupted, the breach raises concerns about the security of proprietary designs and manufacturing data. For electronics suppliers working with global brands, the exposure of confidential information can carry risks even when there is no immediate disruption to operations.

ChipSoft's ransomware attack on healthcare software

Dutch healthcare software provider ChipSoft disclosed a ransomware attack in April and temporarily disconnected several services, including patient portals and its healthcare data exchange platform, as a precaution. Hospital staff could continue using the company's HiX system, but some digital services were unavailable during the disruption.

 

A subsequent forensic investigation found that the attackers had stolen personal data, including medical information, belonging to patients at some Dutch healthcare institutions. ChipSoft later said cybersecurity specialists had prevented the stolen data from being published and confirmed that it had been destroyed. The company did not disclose the total financial cost of the incident.

 

The attack highlights the risks of hospitals relying on a common software provider for patient records, administrative functions and digital services. A breach at one supplier can affect multiple healthcare institutions at once.

Stryker's global medical technology disruption

Medical technology company Stryker said on March 17 it had contained a cyberattack that had disrupted its operations since March 11. The incident affected order processing, manufacturing and shipments across its global business, Reuters reported. Windows-based devices, including laptops and mobile phones, were hit, but the company said its connected medical products and patient-related services were unaffected.

 

The hacking group Handala claimed responsibility, saying the attack was retaliation for a military strike in Iran. This was the group's stated motive and has not been independently verified. Stryker did not disclose the financial impact of the incident.

Poland's energy infrastructure attack

On December 29, 2025, coordinated attacks targeted more than 30 wind and solar farms, a manufacturing company and a large combined heat and power plant supplying heat to nearly half a million customers, according to Poland's national cybersecurity team, CERT Polska.

 

The attackers gained access to industrial devices at renewable energy facilities and attempted to damage controller firmware, delete system files and deploy destructive software known as wiper malware. At the heat plant, the objective was to destroy data on internal systems. Security software blocked the destructive activity before it could interrupt heat supplies. Electricity generation continued despite communications disruption at some renewable installations.

 

CERT Polska described the operation as destructive rather than financially motivated. It identified infrastructure overlaps with activity clusters tracked by cybersecurity companies under names including Berserk Bear and Ghost Blizzard, while noting that this was the first publicly described destructive activity attributed to the cluster. No monetary loss estimate was published in the report.

Jaguar Land Rover's production shutdown

Jaguar Land Rover (JLR) disclosed a cyberattack on September 2, 2025 and shut down its systems to contain the breach. The fallout quickly spread beyond its own operations, bringing production to a halt and disrupting its retail network. The company worked with external cybersecurity experts to restore its systems, with manufacturing resuming in stages from October 8. Production returned to normal levels by mid-November.

 

JLR has not publicly disclosed how the attackers first gained access or identified those responsible. The wider economic fallout was substantial. The UK-based Cyber Monitoring Centre estimated that the incident cost the UK economy £1.9 billion ($2.55 billion) and affected more than 5,000 organisations, including suppliers and dealerships.

 

The impact was reflected in JLR's second-quarter FY26 results. Revenue fell 24 per cent year-on-year to £4.9 billion ($6.57 billion), while the company recorded £196 million ($263 million) in exceptional costs linked to the cyberattack. The revenue decline, however, also reflected other factors and cannot be attributed entirely to the incident.

Collins Aerospace and European airport disruption

A cyberattack on systems provided by Collins Aerospace, a subsidiary of RTX, disrupted automated check-in and boarding at several major European airports, including Heathrow in London, Brussels and Berlin in September 2025. With the systems down, airports had to fall back on manual processes, leading to long queues, delays and cancellations. Brussels Airport cancelled 60 of its 550 scheduled flights on one affected day, Reuters reported.

 

The disruption stemmed from an attack on a third-party platform used by airlines and airports. The European Union Agency for Cybersecurity identified ransomware as the cause, though the attackers' identity and origin were initially unknown. The UK's National Crime Agency later arrested a man on suspicion of offences under the Computer Misuse Act. The overall financial cost has not been established.