The digital transformation of commerce has enabled supermarkets to manage their facilities more precisely, reduce certain operating costs, and monitor essential equipment remotely. However, this dependence on connected systems also introduces risks that may go unnoticed until an incident with material consequences occurs. In October 2026, a cyberattack against the refrigeration systems of hundreds of supermarkets in France highlighted that a computer intrusion does not need to target cash registers, customer databases, or payment platforms to cause commercial losses. In this case, the attackers managed to alter the temperature settings of refrigeration equipment, causing food to deteriorate and forcing affected stores to remove products from their sales areas.
The investigation into the case, reported by Reuters on October 13, 2026, was underway as French authorities attempted to identify those responsible and determine how they had managed to access the refrigeration systems. Among the issues that caught investigators’ attention were the absence of a public claim of responsibility for the cyberattack and the lack of a ransom demand. These elements made it difficult to establish a possible economic, political, or purely demonstrative motive, although they did not, by themselves, rule out any hypothesis. The incident also brought longstanding industrial cybersecurity problems to the forefront, including the use of outdated software, the exposure of control interfaces to the internet, and the difficulties of keeping equipment protected when it may remain operational for many years.
A Cyberattack with Physical Consequences
According to information published by Reuters, at least 350 French supermarkets were affected by the incident, including stores belonging to chains such as Carrefour, Monoprix, Intermarché, and Coopérative U. The figure represented a portion of the country’s supermarkets, but it was enough to demonstrate that a cyberattack against technical systems could simultaneously affect numerous stores. In some establishments in Paris, workers had to remove meat and frozen products that could no longer be stored under appropriate conditions. Images circulated during those days showed large containers filled with spoiled merchandise and refrigeration areas that had temporarily become unusable.
The most significant aspect of the cyberattack was the manipulation of equipment temperatures. According to information reported by Reuters, the attackers manually changed the parameters of the refrigeration systems, preventing them from maintaining the values required to preserve products. A Reuters video report, based on statements from a cyber-risk specialist, indicated that some equipment may have received temperature adjustments of up to 50 degrees Celsius or even higher, although this figure should not be interpreted as a confirmed measurement for every affected establishment. The available information does support the conclusion that remote control of the equipment was used to alter its operation and that the incident resulted in food losses.
This type of cyberattack is particularly significant because it directly connects the digital world with the safety of physical operations. An intrusion into a computer can cause documents to be lost or a service to be interrupted, while the manipulation of an industrial system can alter the operating conditions of a facility. In a supermarket, refrigeration is essential for preserving certain foods, maintaining operational continuity, and complying with applicable health requirements. Therefore, unauthorized access to these controls can cause damage even when there is no evidence that the attackers stole personal or financial information.
The impact is not limited to the moment when the anomaly is detected. Those responsible for each establishment must identify the affected equipment, assess the condition of the products, verify that temperatures return to safe levels, and decide which merchandise can be retained and which must be discarded. They may also need specialized technicians to inspect the controllers and restore the correct configuration. Although the available sources described losses and operational disruptions, they did not provide a consolidated figure that would make it possible to determine the total economic cost of the cyberattack across France.
Refrigeration Systems and the Problem of Outdated Software
One of the central elements of the investigation was the role of the software used to control refrigeration equipment. France’s cybersecurity agency examined technologies associated with Danfoss, a Danish company specializing in refrigeration and industrial control solutions, as well as products from Copeland and its Dixell brand. These programs allow facilities to be monitored and operating parameters to be modified, making it easier to manage numerous devices from a centralized location. However, when a cyberattack exploits weaknesses in access mechanisms, that same remote management capability can become a way to alter how the devices operate.
Danfoss stated that many of the affected devices had reached the end of their useful life and no longer received software or security updates, while others were running older firmware versions. Firmware is the embedded software that allows a device to perform its basic functions and communicate with other components. When a manufacturer stops maintaining a particular version, vulnerabilities that emerge or remain in it may not be corrected through ordinary updates. This does not mean that all older equipment is automatically vulnerable, but a lack of maintenance can increase risks, especially when devices are connected to networks accessible from outside.
The situation also highlighted the importance of technical investigations conducted before the incident. The cybersecurity company Claroty had published analyses of vulnerabilities affecting certain commercial refrigeration controllers, including Danfoss products. These devices can be used to monitor facilities and manage operating parameters. Nevertheless, the existence of known vulnerabilities does not prove that they were necessarily exploited during the October cyberattack. Without complete forensic findings, it is impossible to state that all affected establishments used the same software version or that a single weakness explains every intrusion.
Copeland, the owner of Dixell, also acknowledged the existence of a vulnerability and stated that it was working with its customers to reduce risks and strengthen security. The presence of different technologies complicated the analysis because each manufacturer may use different architectures, versions, and protection mechanisms. Investigators needed to determine whether common patterns existed among the affected devices and what measures had allowed the attackers to access them. Understanding an industrial cyberattack therefore requires examining both software vulnerabilities and the specific configuration of each installation.
Interfaces Exposed to the Internet: An Entry Point
Another concerning issue was the number of control interfaces that remained visible on the internet. According to Reuters, a search conducted on October 13 using Shodan, a service that identifies devices connected to public networks, found at least 4,500 Danfoss interfaces accessible online. This figure does not mean that 4,500 devices were vulnerable, nor does it prove that they were all installed in French supermarkets. However, it indicates that there was a considerable exposure surface and that numerous administrative interfaces could be located from outside.
The French internet analysis company Onyphe reported that only a small proportion of the observed devices appeared to be running the latest software version. It also indicated that older versions remained widespread among publicly accessible interfaces. These observations do not make it possible to calculate precisely how many devices could be compromised, since a device being visible does not, by itself, prove that it is vulnerable. Nevertheless, the findings justify reviewing connections and protection mechanisms to reduce the likelihood of a cyberattack affecting essential facilities.
Direct exposure of an administrative interface means that a service designed for technicians to manage equipment may be accessible from external networks. If that interface has authentication flaws, uses weak credentials, or lacks sufficient access restrictions, an unauthorized third party could attempt to take control. The risk increases when organizations do not know which devices are connected, who administers each one, or whether they continue to receive updates. Security therefore depends not only on software quality but also on how systems are configured, connected, and maintained over time.
To reduce these risks, companies should avoid making administrative panels directly accessible from the internet when there is no justified need. Remote access can be organized through virtual private networks, strong authentication, and connections restricted to authorized users. It is also advisable to separate refrigeration equipment from networks used by office computers, payment systems, and customer devices. These measures cannot guarantee that a cyberattack will never occur, but they can make it more difficult for an initial intrusion to develop into a widespread disruption of operations.
The Absence of a Claim of Responsibility and Questions About the Attackers
The lack of a public claim of responsibility was one of the issues that puzzled French investigators. In many financially motivated cyberattacks, perpetrators attempt to obtain money through ransom demands, while certain activist groups seek visibility and present their actions as political protests. In this case, according to Reuters, no group had publicly claimed responsibility, and no ransom demand had been reported. The absence of these familiar signals complicated the interpretation of the cyberattack but did not, by itself, establish who was behind it.
Specialists consulted by Reuters considered the incident relatively straightforward to carry out if the systems were exposed and contained known vulnerabilities. Ken Munro, a partner at the British firm Pen Test Partners, suggested that the apparent ease of the intrusion could be consistent with a relatively unsophisticated operation. He also questioned whether the incident necessarily resembled an operation sponsored by a state, although these assessments were not official conclusions about the attackers’ identities. The investigation needed to establish whether evidence existed linking the attack to a specific person, organization, or motive.
Several hypotheses could explain a cyberattack of this kind. One possibility is that those responsible wanted to demonstrate that they could access inadequately protected industrial systems; another is that they intended to cause financial losses, create alarm, or disrupt operations without seeking direct financial gain. It is also possible that the initial objective differed from the damage ultimately observed. Without forensic evidence, communications attributable to the attackers, or verifiable indications of their behavior, none of these possibilities should be presented as an established fact.
Attributing a cyberattack requires much more than identifying a vulnerability used by intruders. Investigators must analyze access logs, connections, configuration changes, and possible traces of activity in other systems. Even when infrastructure related to an incident is identified, determining who controlled it can be difficult because attackers may use intermediary services or previously compromised devices. For this reason, determining how an intrusion occurred and establishing who ordered it are separate tasks that may progress at different rates.
Economic Consequences and Food Safety
The impact of the cyberattack extended beyond the malfunction of technical equipment. Supermarkets depend on refrigeration to preserve perishable products during storage, preparation, and display, so a prolonged temperature disruption may require merchandise to be discarded. A food product’s appearance does not always reveal whether it has been kept under safe conditions. When its storage history cannot be adequately verified, removing affected products helps reduce risks to consumers.
Economic losses may include the value of discarded food, repair costs, and business interruptions. Additional expenses arise from the working hours required to remove products, inspect facilities, and verify that the controls are functioning correctly. A frozen-food section that is out of service may also temporarily limit product availability and reduce sales. Without consolidated financial data from the affected companies, it is not possible to establish a reliable figure for the total cost of the cyberattack in France.
The cold chain is an essential part of food distribution. Refrigerated and frozen products depend on appropriate storage and transportation conditions from their origin to the point of sale, although specific requirements vary by food type. If a control system loses its integrity, product preservation may be affected, and additional checks may be necessary before operations resume. The incident demonstrates that cybersecurity can indirectly influence food safety, even when the immediate target is the equipment responsible for maintaining storage conditions.
For consumers, the consequences may include temporary shortages of certain products or changes in the usual availability of items at a store. For businesses, the incident also raises questions about trust: customers expect retailers to maintain appropriate procedures to protect the food they sell. A transparent response, with clear information about removed products and corrective measures, can help manage the situation. Nevertheless, the available data do not support the claim that the cyberattack caused a nationwide food crisis or widespread shortages.
Prevention as a Business Priority
The first measure for preventing similar incidents is to maintain an accurate inventory of the equipment that forms part of the technological infrastructure. A company can hardly protect a controller if it does not know that it exists, which software version it uses, or who is responsible for maintaining it. An up-to-date inventory should include industrial devices, their network connections, the manufacturer’s support status, and dependencies on external providers. This information makes it possible to identify the highest-risk areas and prioritize interventions before a cyberattack occurs.
The second measure is to establish an ongoing process for updating systems and managing vulnerabilities. Organizations should check which security fixes are available, assess their applicability, and schedule their installation to minimize disruption. When a device no longer receives maintenance, companies should consider replacing it or applying compensating controls, such as strictly limiting connectivity and restricting who can administer it. Decisions should take into account both the cost of updating equipment and the potential consequences of leaving it exposed.
The third measure is to separate industrial systems from other networks and protect remote connections. Network segmentation can limit the scope of an incident and prevent a compromised device from facilitating access to other systems. Where compatible, multifactor authentication, unique credentials, activity logs, and restricted permissions help reduce opportunities for unauthorized access. In addition, companies should review connections used by external providers, since remote technical assistance may be necessary but should not imply permanent, unrestricted access.
It is also important to have monitoring and response mechanisms in place. Unexpected temperature changes, parameter modifications, and disabled alarms should generate alerts that can be reviewed promptly. Automated controls should be complemented by procedures for physically checking equipment and responding to unusual behavior. Companies need contingency plans specifying how to isolate a compromised system, preserve evidence, protect food products, and restore operations safely. Advance preparation can shorten response times and prevent a cyberattack from turning into a more extensive commercial loss.
The cyberattack against the refrigeration systems of French supermarkets in October 2026 illustrates how digital vulnerabilities can have physical, economic, and operational consequences. Temperature manipulation affected stores belonging to different chains, led to food being removed, and prompted scrutiny of technologies used to control essential facilities. Information published by Reuters identified older equipment, missing updates, and internet-exposed administrative interfaces as relevant factors. At the same time, important questions remained about the exact method of intrusion, the attackers’ identities, and their possible motives.
The incident does not prove that all connected systems are insecure or that all older equipment can be attacked easily. It does show that technology designed to facilitate remote monitoring requires security controls proportionate to the consequences of its manipulation. In a supermarket, digital protection is not only about preserving data and preventing computer disruptions; it is also about maintaining facilities essential to food preservation. For this reason, equipment updates, access restrictions, network segmentation, and monitoring of operating parameters should be part of everyday management.
The absence of a public claim of responsibility and a ransom demand also serves as a reminder that not every attack can immediately be explained by familiar patterns of cybercrime. Without conclusive evidence, attributing the incident to a specific group or asserting its purpose would be speculative. Technical and police investigations are necessary to establish these details and distinguish hypotheses from verified facts. Meanwhile, the central lesson is clear: protecting a company’s digital infrastructure also means protecting its physical operations, financial resources, and, in certain circumstances, the safety of products reaching consumers.
For organizations seeking to anticipate these threats, specialized advice can make a difference in identifying vulnerabilities, protecting systems, and preparing for incidents. ITD Consulting invites businesses to assess their cybersecurity needs and strengthen their technological infrastructure with solutions tailored to their operations. To learn more about its services, write to [email protected] and discover how to improve prevention, detection, and response to a potential cyberattack.
EN 
ES