Hackers turned refrigeration systems into a source of disruption across French supermarkets, exposing a blind spot in how businesses assess the cyber risks hiding in their supply chains.
A supermarket refrigerator is not the sort of thing most people associate with a cyberattack. It is meant to keep food cold, run quietly in the background, and require little attention from anyone beyond the people who stock its shelves.
But in France, on October 12, reports emerged of a cyberattack disrupting refrigeration systems across hundreds of French supermarkets. The incident was an operational technology (OT) attack that exposed supply-chain risks.
The target was not the usual customer database or a corporate network, but the systems responsible for keeping food cold. Attackers reportedly manipulated connected Danfoss cooling controllers, triggering defrost cycles and allowing temperatures in some units to rise as high as 50 degrees Celsius. The Panorays’ Threat Center report found that the affected units were running outdated firmware, raising questions about the security of the equipment and the risks it posed to the supermarkets relying on it.
The consequences were tangible: spoiled stock, disrupted store operations and, according to additional reports, fires at some locations. It was a supply chain security problem with unmistakably physical consequences.
“A security breach from a supplier disrupts a business, even when its own systems are not compromised.”
An attack with physical consequences
Panorays’ Threat Center was tracking the incident in real time. A Threat Center Report generated brought together the emerging coverage, a timeline of developments, and an analysis of the reported attack. The report identified Intermarché, Coopérative U and E.Leclerc among the affected retailers and highlighted the reported involvement of Danfoss cooling control systems. The Associated Press’s AFP reporting and The Guardian’s coverage independently documented the disruption and retailers’ statements.
According to the Panorays Threat Center report, Les Mousquetaires (Intermarché/Netto) said that approximately 150 to 300 of its stores were targeted, while Coopérative U, Carrefour, and Monoprix reported that almost 100 outlets were affected. E.Leclerc stores also reported being hit. The report put the estimated scale at between 250 and 300 supermarket locations.
The sequence of developments was revealing. Initial reporting described refrigeration systems being manipulated and temperatures rising. French authorities confirmed that an investigation was underway. Danfoss subsequently noted that the affected cooling control units were running outdated firmware, while Intermarché and Coopérative U acknowledged that their stores had experienced the disruption.
Further reporting revealed that the attack affected multiple supermarket chains, with spoiled food and fires reported at some locations, according to CBS News, citing AFP. Danfoss told AFP that most of the affected equipment consisted of legacy controllers that no longer receive software or security updates, including the AK-SM 800 and AK-SC 355 models.
France’s cybersecurity agency, CERT-FR, reported that refrigeration controllers had been compromised through management interfaces exposed to the internet. It advised disconnecting the devices or restricting access to them. Outdated equipment connected to the internet can leave businesses exposed to attacks on their suppliers, with consequences that reach far beyond their IT systems and into day-to-day operations.
What was already clear was the nature of the impact. This was not simply a matter of files being stolen or computers being locked. The systems involved helped preserve products that stores depended on selling. When those systems failed, the consequences moved from the digital world into the physical one.
The cost of such an incident accumulates quickly: spoiled inventory, lost sales, disrupted store operations, and the work required to restore normal conditions. The full bill may also include investigations, equipment checks and the loss of customer confidence. Intermarché alone estimated that the attack could contribute to tens of millions of euros in losses across the country.
The risk hiding in plain sight
The reported involvement of Danfoss cooling control technology brings a familiar challenge in cybersecurity into sharper focus. Modern businesses depend on an expanding network of external providers, from cloud platforms and software vendors to the connected equipment that keeps physical operations running.
These relationships are often essential. Remote monitoring and management can make equipment easier to maintain and operate. But the same connections can create dependencies that are difficult for a customer to see clearly, let alone control.
The broader lesson is not limited to one manufacturer or one supermarket chain. A business may have strong controls over its own network and still depend on equipment, software, or services whose security it does not manage directly.
That is the central challenge of third-party cyber risk management. The risk is not confined to the supplier’s own organization. It can travel through the services and technologies on which customers depend, surfacing as an outage, a production delay, a disrupted delivery or, in this case, refrigeration that no longer keeps food cold.
Why timing matters
The Panorays Threat Center report offers another lesson: in a developing cyber incident, the value of information depends partly on how quickly organizations can assemble and interpret it.
The report was generated at 18:08 UTC on October 12, after the incident had been opened in the Threat Center earlier that afternoon. It consolidated reporting from The Independent and Data Breaches, recorded the reported developments in chronological order, and distinguished between information reported by outside sources and details acknowledged by the companies involved.
The report’s timeline showed how the picture developed: the reported manipulation of refrigeration systems, the authorities’ investigation, the statement about outdated firmware, and the affected retailers’ acknowledgments. Its analysis connected the reported activity to the operational disruption without treating every unanswered question as settled.
For organizations responsible for large supplier ecosystems, this kind of structured intelligence can help turn a stream of news into a more useful set of questions. Is a supplier or technology we rely on involved? Do we have a similar dependency? Could the incident affect our operations? Is there enough evidence to investigate or take precautionary action?
Threat intelligence cannot establish an organization’s exposure on its own. Nor does an alert automatically mean that a particular supplier is compromised. It does, however, help security teams identify where to look and make decisions while an incident is still unfolding.
From a security rating to a business question
The supermarket attack exposes a limitation in how organizations sometimes evaluate third-party risk.
A supplier’s security rating can be useful. So can a questionnaire, an audit, or a periodic assessment. But none of these, in isolation, answers the most important operational question: what happens to our business if this supplier’s technology is disrupted?
Answering it requires more than knowing whether a third party meets a baseline of security requirements. Organizations need to understand which suppliers support critical processes, what systems and services those suppliers provide, and how a failure could affect revenue, operations, or customers.
They also need to revisit those assumptions as circumstances change. A supplier assessment completed months ago may not reflect a new vulnerability, a developing incident, or a change in the technology on which the business depends.
Panorays’ third-party cyber risk management platform supports the assessment and monitoring of supplier cybersecurity, while its Threat Center provides structured information about developing incidents, including timelines and incident analysis. The aim is to help organizations move from collecting security information to understanding what it may mean for their own supplier ecosystems.
The perimeter is no longer the whole story
The French supermarket incident began with a system designed to do something ordinary: keep perishable food cold. Its disruption showed how a weakness involving connected technology can reach beyond the organization that supplies it and affect the businesses that rely on it.
For retailers, that means looking beyond the security of payment systems, customer data, and corporate networks to the equipment and external services that keep stores operating. For security leaders more broadly, it means treating supplier risk as an operational question as much as a technical one.
The refrigerators in France offered a vivid reminder that cyber risk does not always announce itself with a stolen database or a ransom note. Sometimes, it arrives in the form of a rising temperature and the realization that a critical part of the business depends on a system someone else helps maintain.
The question for every organization is simple, even if answering it is not: If a supplier’s technology failed tomorrow, would you know what was at risk and what to do next?
