Thousands of internet-accessible refrigeration control interfaces may remain exposed after a cyberattack affected supermarkets in France, prompting cybersecurity authorities to call for stronger protection of connected equipment.
The attack, which occurred over the weekend before October 14, disrupted refrigeration systems at hundreds of French supermarkets. Staff at affected stores reported temperature increases that damaged fresh and frozen food, forcing retailers to discard products and inspect equipment before returning it to normal operation.
Editorial Insight
Key Highlights
Important points readers should notice.
Issue/Event: Cyberattacks disrupted supermarket refrigeration systems in France, while thousands of internet-accessible control interfaces were reported to remain exposed.
Location: Supermarkets across France; the wider issue concerns internet-connected refrigeration equipment.
Authority/Organisation: French cybersecurity authorities, affected supermarket operators, Danfoss and Copeland.
Action Taken: Authorities advised retailers to secure exposed systems, restrict internet access, verify configurations and apply available security updates.
Impact: Food losses, refrigeration disruption and renewed concern about unsupported industrial equipment and the security of food-retail infrastructure.
French authorities said the incidents involved remote-control modules used to manage refrigeration systems. The affected technology included equipment supplied by Danish company Danfoss and US-based Copeland, which owns the Dixell refrigeration-control brand.
The French cybersecurity agency warned that the threat could still be active and advised operators to secure affected systems before reconnecting them to the internet. Investigators had not publicly identified the attackers or established a confirmed motive.
Why Thousands of Devices May Still Be Vulnerable
Editorial Analysis
Why This Matters
The incident shows that cybersecurity risks can affect physical goods and essential business operations, not just digital information. Refrigeration failures can damage stock, increase costs and require food-safety assessments. For businesses, securing connected equipment is part of protecting customers, workers and supply-chain reliability. It also offers a practical lesson for organisations that rely on older technology: a device that still works mechanically may no longer be safe to operate on an unrestricted network.
The incident has drawn attention to a wider cybersecurity problem: equipment that performs a physical task may also be connected to the internet and managed remotely.
Supermarket refrigeration systems use controllers and sensors to monitor temperatures, manage cooling cycles and alert staff when equipment requires attention. Remote access can help technicians diagnose faults and maintain equipment without visiting every store.
However, an exposed control interface can create an entry point for unauthorised access if it is poorly secured, incorrectly configured or running vulnerable software.
Cybersecurity researchers have previously identified weaknesses in certain refrigeration-control platforms. Reporting published after the French incident indicated that thousands of interfaces associated with Danfoss equipment remained visible online, while older software versions continued to appear on publicly accessible systems.
Visibility on the internet does not automatically mean that every interface is vulnerable or compromised. The actual risk depends on factors such as software version, authentication, network configuration, security controls and whether known vulnerabilities have been patched.
The incident nevertheless demonstrates why businesses must identify internet-facing equipment and ensure that remote access is limited to authorised users and services.
Older Equipment Creates a Difficult Security Challenge
A significant concern is that some affected refrigeration controllers were older products that no longer receive software or security updates.
Equipment used in supermarkets, warehouses and other industrial environments can remain operational for many years. Replacing it may require substantial expenditure, technical planning and temporary disruption to business operations.
That creates a gap between the physical lifespan of a machine and the period during which its software can be securely maintained.
When a device reaches the end of its supported life, businesses may continue using it because it still performs its intended function. But without security updates, newly discovered vulnerabilities can become increasingly difficult to address.
Organisations do not necessarily need to replace every older device immediately. They should, however, assess the risk, isolate unsupported equipment from public networks where possible, restrict remote access and establish a replacement plan for systems that cannot be secured adequately.
How the Attack Affected Supermarkets
The attackers reportedly manipulated refrigeration settings, causing temperatures to rise and damaging food stored in affected display units.
French officials said hundreds of supermarkets were affected. The exact number varied across reports and statements, reflecting different assessments of the incident and the number of stores experiencing disruption.
The consequences included discarded fresh and frozen products, equipment checks and temporary interruptions to normal operations. Some stores had to inspect their refrigeration units and replenish damaged stock before fully restoring normal service.
The incident also highlighted the importance of temperature monitoring. Refrigerated food can become unsafe if it remains outside required temperature conditions for too long. Retailers must therefore assess affected stock under applicable food-safety procedures rather than assume that products remain suitable for sale simply because a unit has resumed cooling.
No conclusion about the safety of all food sold by affected retailers should be drawn from the cyberattack alone. The relevant assessment depends on the products involved, temperature records, the duration of exposure and the retailer's food-safety controls.
Why the Food Supply Chain Is Part of the Cybersecurity Debate
Supermarkets depend on a connected network of refrigeration equipment, inventory systems, warehouses, ordering platforms, distribution centres and transport services.
An incident affecting one part of that network can create additional work elsewhere. Stores may need to discard stock, reorder products, adjust deliveries and temporarily change how they manage inventory.
Modern retail systems often rely on frequent deliveries rather than maintaining large reserves at every location. This approach can reduce storage costs and food waste under normal conditions, but it can leave less room for disruption when ordering systems, refrigeration equipment or transport networks fail.
The French incident does not establish that the country's overall food supply was at risk. Officials said there was no threat to national food supplies. However, it illustrates how a technical failure or cyberattack can create operational and financial consequences across individual businesses and their suppliers.
For retailers, cybersecurity is therefore not limited to protecting customer databases or payment information. It also involves protecting the equipment that keeps products safe and stores operational.
What Businesses Can Do to Reduce the Risk
Cybersecurity authorities have advised operators to avoid exposing refrigeration-control systems directly to the public internet. Remote connections should use secure, properly configured access methods, including virtual private networks where appropriate.
Businesses should also change default passwords, apply available firmware updates, restrict access to authorised technicians and review which devices can communicate with external networks.
Unsupported equipment requires additional attention. Where updates are unavailable, operators should consider isolating the system, restricting incoming connections, monitoring access and planning a replacement if the remaining risk cannot be managed.
Regular checks can help identify devices that have been forgotten during technology upgrades or remain accessible through outdated configurations. Businesses should maintain an inventory of connected equipment and know which supplier is responsible for maintaining each system.
The incident also underlines the importance of operational contingency plans. Retailers need procedures for responding to temperature alarms, checking potentially affected food, maintaining records and restoring equipment safely after a suspected compromise.
