For years, European governments have worried about hostile actors disrupting electricity grids, communications networks and transport systems. Refrigeration equipment in neighbourhood supermarkets attracted considerably less attention. Yet the cyberattack that swept through French grocery chains on October 12 has exposed how readily ordinary commercial machinery can become a target, and how expensive the consequences can be.
The attack began overnight on October 11, when hackers remotely interfered with refrigeration controllers, forcing some supermarket refrigerators and freezers to temperatures approaching 50°C. At Les Mousquetaires, which operates Intermarché, roughly 150 stores were affected, with some equipment remaining at those temperatures for six hours. Carrefour reported disruption at 80 locations, while Monoprix and Coopérative U were among the other retailers affected.
Entire stocks of fresh and frozen products had to be discarded. Fires were also reported, and losses across the affected businesses could run into tens of millions of euros.
The incident has since become a matter for French prosecutors and the country's national cybersecurity agency, ANSSI. On October 12, France's computer emergency response team published an alert identifying numerous compromises involving the AK-SM and AK-SC refrigeration-management systems manufactured by Danish engineering company Danfoss.
The geographical reach may extend beyond France. Cybersecurity researcher Félix Aimé of Sekoia reported affected systems in Spain, Portugal, Germany, Poland and Belgium, although the extent of any disruption in those countries has not been independently established.
What investigators find may have consequences beyond the retailers' insurance claims. European supermarkets operate through extensive networks of suppliers, contractors and maintenance providers, often relying on equipment manufactured and supported across several countries. The same remote connections that enable technicians to manage refrigeration installations efficiently can expose stores to intrusion when access is poorly secured.
There had already been warnings about Danfoss equipment. In August, cybersecurity researchers at Claroty published findings on vulnerabilities in the AK-SM 800A controllers, including weaknesses that could permit unauthorised access or the execution of malicious commands. Danfoss subsequently released updated firmware. The company has said the systems affected in France were running outdated software, although the precise method used in the October attack remains unconfirmed.
For the European Union, the timing is awkward. Its NIS2 Directive already brings certain food production, processing and distribution businesses within the continent's cybersecurity framework. The Cyber Resilience Act, intended to improve the security of connected products, introduced mandatory reporting of serious incidents and exploited vulnerabilities in September, but most of its requirements will not apply until December 2027.
Neither framework guarantees that equipment already installed in supermarkets will receive timely updates, or that operators will restrict remote access adequately.
French investigators must still establish who carried out the attack and how the refrigeration controllers were compromised. The bigger question is whether the continent's increasingly connected food-distribution networks can be adequately protected when the security of individual stores depends on software, equipment manufacturers and maintenance arrangements that extend well beyond national borders.
