The refrigeration attacks expose a difficult recovery problem: restoring control of a machine cannot restore the food it has spoiled.
In the early hours of 12 October 2026, a cyberattack turned refrigeration systems across French supermarkets into a source of losses. Retailers reported temperatures reaching 50°C, spoiled food and disrupted operations. The Paris prosecutor’s office described a large-scale attack affecting several major food retailers, according to Reuters’ initial reporting.
The consequences reached well beyond a computer screen. Once temperature-sensitive goods had deteriorated, getting the equipment working again could only solve part of the problem.
That distinction makes this incident worth understanding even for readers who have never managed a supermarket. When software controls a physical process, recovery has several tests: is the system secure, is the product safe, and can the operation function again? Those answers may arrive at different times.
What is confirmed about the French supermarket attack?
France’s CERT-FR, part of the national cybersecurity agency ANSSI, confirmed compromises affecting Danfoss AK-SM and AK-SC refrigeration controllers, alongside Copeland and Dixell XWEB systems. Its incident alert, first published on 12 October and updated on 16 October, warned that attacks were probably continuing.
The scale requires careful attribution. Reuters reported at least 350 affected supermarkets in its investigation coverage. Associated Press subsequently quoted Finance Minister Roland Lescure putting the number at about 700. These are reported estimates, not a single reconciled incident count. Lescure also said France’s food supplies were not at risk.
The attack’s consequences are clearer than its attribution. In the reporting reviewed through 21 October, the perpetrators had not been publicly established. Reuters’ investigation report also said the precise compromise mechanism had not been disclosed. Neither the existence of known vulnerabilities nor the absence of a public ransom demand establishes who was responsible.
How a refrigeration controller becomes a physical risk
Commercial refrigeration involves more than an appliance plugged into a socket. A management platform can coordinate equipment throughout a site, give technicians remote access and let them change operating settings.
In its research on the Danfoss AK-SM 800A, published on 9 August 2026, cybersecurity company Claroty described a central interface for adjusting temperature thresholds, schedules, alarms and user permissions. Its researchers found vulnerabilities and disclosed them to Danfoss, which issued fixes.
That research demonstrates what a compromised management interface can make possible. It does not, by itself, establish which vulnerability attackers used in October.
The important relationship is straightforward: a software setting can change how physical equipment behaves. A refrigeration system may still be powered and responding to instructions while those instructions are unsuitable for preserving its contents.
This is an example of operational technology, or OT: programmable systems that monitor or control physical processes. The US National Institute of Standards and Technology’s OT security guide treats safety, reliability and performance as central requirements. That technical framework helps explain the incident; it is not a statement of French legal obligations.
For a retailer, the practical question becomes whether the equipment is maintaining the right conditions—not simply whether its software is online.
A working refrigerator does not prove its contents are safe
Restoring the desired temperature cannot establish what happened to the food while control was lost.
France’s Agriculture Ministry explains that storage requirements differ by food type. Its published table specifies, for example, a maximum of 2°C for chilled minced meat and −18°C for ice cream. These are storage requirements, not a universal rule for judging every product after an incident.
The relevant questions include which goods were exposed, how warm they became and how long the exposure lasted. A normal reading after repairs cannot answer all three.
The ministry’s consumer food-safety guidance also advises against refreezing thawed products. For an affected store, decisions about stock require its food-safety procedures and appropriate assessment; an IT technician restoring access cannot make that decision on the system’s behalf.
The human cost appears in a published account from Business Insider. Julien Fréret, director of Intermarché La Haye-du-Puits in Normandy, described disposing of about 30 cubic metres of food. His team then had to clean and restock. This was his account to that publication, rather than an independently audited loss assessment.
There was also evidence that rapid intervention could limit damage. Le Monde reported that a supermarket near Bordeaux avoided stock losses after monitoring detected an abnormal temperature rise and teams intervened.
An affected controller, then, did not automatically mean an identical outcome at every store. Detection and response could make a material difference.
Recovery needs three separate decisions
The French incident suggests a useful way to organize recovery: separate control of the equipment, the condition of the goods and readiness to resume normal trading.
The table below is an editorial synthesis of the incident and the cited security and food-safety guidance. It is a discussion aid for the responsible teams, rather than a device-specific repair procedure.
| Recovery decision | Evidence to establish | People who need to coordinate |
| Can the equipment be trusted again? | The access route has been secured; configuration and accounts have been checked; and applicable manufacturer recovery steps have been completed. | IT/security staff and the refrigeration contractor. |
| Can the affected stock be retained? | Actual product conditions and available temperature history have been assessed against the relevant food-safety requirements. | The store’s food-safety lead and operational staff. |
| Can normal trading resume? | Suitable stock is available, the refrigeration is performing correctly and alerts reach someone able to respond. | Store management, maintenance and replenishment teams. |
These decisions overlap, but none substitutes for another. A contractor can restore cooling while stock remains unsuitable for sale. A store can replace damaged goods while an exposed controller leaves the new stock vulnerable.
The most useful recovery record therefore connects the technical work to operational checks. “The device restarted” is a much narrower statement than “the refrigerated section is ready to reopen.”
Why a factory reset is not enough
CERT-FR’s October alert makes a specific distinction between restoring equipment and removing its exposure to attack. It warns that resetting an unsupported device while leaving it exposed can result in another compromise.
Its recommendations include removing public internet access, checking configuration—including defrost schedules—and restoring remote access through a secured VPN or protected network. Operators are also told to check insurance conditions before interrupting data reporting to their refrigeration provider. That detail matters: containment needs coordination with the people responsible for monitoring. CERT-FR
The Copeland and Dixell guidance linked by CERT-FR adds concrete checks. These include recording findings before changes, reviewing accounts, checking alarm recipients, testing notifications and directly checking product temperatures after suspected unauthorized access.
Its lifecycle warning is equally relevant. XWEB EVO is described as an end-of-service platform without further security patches. The document recommends migration to a supported platform while stressing that the newer XWEB PRO should not be directly exposed to the public internet either.
Replacing old equipment and securing remote access address different problems. A newer model does not make an unsafe network arrangement acceptable.
Cyber insurance may leave a separate recovery problem
The financial consequences also cross boundaries.
In Reuters’ 15 October insurance report, brokers said cyber policies typically exclude physical losses, potentially leaving spoiled stock outside cover. The report also described specialist protection for perishable goods.
That is not a verdict on every affected retailer’s claim. Coverage depends on the actual contract and circumstances.
For an operator, the useful question is specific: does the policy respond when a cyber incident causes temperature-controlled stock to deteriorate? “We have cyber insurance” does not answer it.
The test is what happens before the food is lost
The wider lesson is about the connection between technical control and physical consequences. The French incident makes that connection visible in an ordinary setting: chilled aisles, store staff and food that customers expected to buy.
For organizations using connected equipment, a useful exercise is to follow one plausible failure all the way through. Who detects it? Who receives the alert overnight? Who can intervene? What evidence is needed before the equipment and its contents can be trusted again?
Those questions bring cybersecurity into the same conversation as maintenance and safety. Once a controller can alter the conditions that keep a product usable, protecting that controller becomes part of protecting the product itself.
