Cyberattacks Knock Out Refrigeration Systems at Hundreds of Supermarkets in France

Hundreds of supermarkets in France were hit by cyberattacks on Sunday night. According to Bloomberg, their refrigeration systems went down, and the stores had to throw out spoiled food. This is a rare cyber story in which the damage is measured not in leaked records but in tons of meat, dairy and frozen food in dumpsters.

What we know so far

Very few details are public. The initial report fits in a single sentence, and everything else remains unanswered questions. Here is what has been confirmed:

• Scale: "hundreds" of retail locations in France.
• Timing: Sunday night, when stores have minimal staff and response to alarms is slower.
• Target: cooling systems, not just checkout or office infrastructure.
• Consequence: some food spoiled and was disposed of.
• Not disclosed: the name of the chain or chains, the group responsible, the motive, the method of intrusion, the amount of damage.

It is not even clear whether this is a single chain. "Hundreds of stores" could belong to one retailer, to several brands, or be serviced by one contractor. Everything else depends on the answer.

Why cooling became a target

Refrigeration units in a modern supermarket are no longer standalone appliances. They are connected to building monitoring and management systems, send telemetry, accept temperature setpoints and are often serviced remotely by an outside company. For the operator, this saves on technician visits and protects against spoilage. For an attacker, it is an entry point into a physical process.

The logic is simple. Shutting down the checkouts is a nuisance: the store loses revenue, but the goods stay intact. Stopping the cooling starts a timer: for fresh food, the safe window is measured in hours. Pressure on the victim builds faster than with ordinary file encryption. The owner has to decide whether to pay a ransom or dispose of the stock before incident response specialists have had time to work out what happened.

There is precedent. In July 2021, the Swedish chain Coop was paralyzed through a compromise of software from the vendor Kaseya: about 800 stores closed because their checkouts stopped working. The blow did not land on the retailer itself but on the contractor that serves it. If the French case works the same way, the main weakness lies in the supply chain, not in the perimeter of individual stores. But that is a hypothesis, not an established fact.

What retailers and infrastructure operators should check

Until the investigation is complete, conclusions should be drawn cautiously, but the basic measures do not depend on it.

1. Inventory of connected equipment. You need a list of everything that controls temperature, and an answer to the question of who can control it and from where.

2. Network segmentation. Refrigeration controllers should not sit in the same segment as checkouts, corporate email and guest Wi-Fi.

3. Contractor control. Remote access for service companies should use multi-factor authentication, be limited in time and be logged.

4. Autonomous mode. A controller should hold a safe temperature without a connection to the cloud and the control center, and should not execute dangerous commands from outside without confirmation.

5. Manual plan. Staff need instructions for an emergency: who checks the temperature and at what time, where to move the goods, at what readings to write them off.

6. Insurance and drills. The policy should cover spoilage of goods caused by a cyberattack, and the "cooling shut off overnight" scenario should be practiced in the real world.

The story remains open. So far, no one has named the chain, the cause or the final damage. But the pattern is already clear: a cyber incident is no longer just a question of data, but of the physical safety of goods.