French Supermarkets Hit by OT Cyber Attack: The Cold Chain Crisis

The intersection of Operational Technology (OT) and the public internet has long been a point of anxiety for cybersecurity experts. On the night of October 11, 2026, that anxiety became a costly reality for the French retail sector. In a coordinated strike, unidentified attackers seized remote control of refrigeration systems across hundreds of supermarkets, not to steal data or demand a ransom, but to physically destroy inventory by turning freezers into ovens.

The attackers targeted the controllers that manage the cooling cycles of entire stores. By remotely activating defrost modes and cranking temperatures up to 50°C (122°F), they effectively neutralized the cold chain. For several hours, perishable goods—from meats to dairy—were exposed to extreme heat, rendering them unfit for human consumption and, in some extreme cases, triggering actual fires within the stores.

The scale of the retail carnage

The financial impact is staggering, with some executives estimating losses in the tens of millions of euros. The attack was widespread, hitting several of France's most prominent distribution networks. The Hacker News reports that the reach of the breach varied by chain, but the systemic nature of the vulnerability meant no major player was entirely safe.

Intermarché and Netto, both under the Les Mousquetaires group, bore the brunt of the attack. While reports vary, some figures suggest up to 300 stores across both brands were affected. Thierry Cotillard, head of Les Mousquetaires, confirmed that affected stores had to discard all compromised products to ensure public safety. Other major players were not spared: Carrefour reported breaches in 80 supermarkets, and Monoprix noted issues in approximately 30 locations. Even Coopérative U saw 80 of its 2,000 stores targeted, though CEO Dominique Schelcher noted that quick reactions from staff and contractors saved stock in a majority of those instances.

A failure of legacy hardware

The technical catalyst for this disaster was not a sophisticated zero-day exploit in modern software, but rather the persistence of obsolete hardware. The attackers exploited controllers manufactured by the Danish company Danfoss. Specifically, the breach targeted the AK-SM and AK-SC series, devices designed to allow maintenance firms to manage refrigeration remotely.

The tragedy of the incident lies in the fact that the vulnerability was known and the hardware was outdated. Danfoss revealed that most of the compromised units were older models that no longer receive security updates. The AK-SC 355 was phased out as far back as 2016, and the AK-SM 800 reached its end-of-life in May 2021. Despite a newsletter sent by Danfoss in October 2025 urging customers to replace these units, many supermarkets continued to rely on them.

Even newer models, such as the AK-SM 800A, were compromised. In these instances, the failure was not the hardware itself but the maintenance of it; the units were running outdated firmware, leaving the digital door open for the attackers.

The danger of exposed OT interfaces

This incident highlights a critical flaw in how industrial systems are integrated into corporate networks. Operational Technology—the hardware and software that detects or causes a change through the direct monitoring and/or control of physical devices—was never originally designed to be exposed to the open web. When these systems are connected to the internet for the convenience of remote maintenance without robust security layers, they become low-hanging fruit for criminals.

The incident shows how obsolete OT controllers, unupdated firmware, and exposed access can transform a cyber vulnerability into a direct risk to food security.

Unlike traditional IT attacks that target databases or encrypt files for ransom, this was a physical attack executed via digital means. By manipulating the temperature set-points, the attackers bypassed the logic of the cooling system, turning a tool for preservation into a tool for destruction. As noted by Cybersecurity360, the lack of segmentation between the internet and the refrigeration controllers allowed the attackers to operate with devastating efficiency.

Emergency responses from French authorities

The reaction from the French government was swift. CERT-FR, the national computer emergency response team, issued an urgent alert on October 12. The agency, which operates under the umbrella of ANSSI (the National Cybersecurity Agency of France), identified the specific Danfoss series at risk and provided immediate mitigation steps.

Vincent Strubel, head of ANSSI, emphasized the urgency of the situation, instructing operators to either completely disconnect the affected controllers from the internet or implement extremely tight access filtering. The goal was to stop the bleeding by removing the remote access vector that the attackers were using to pivot into the store systems.

Lessons for the global supply chain

The French supermarket crisis is a blueprint for the vulnerabilities present in global logistics. The reliance on a single vendor's legacy hardware across multiple competing chains created a systemic risk. If one controller model is vulnerable, every company using that model becomes a target.

The incident underscores the necessity of a rigorous lifecycle management policy for industrial hardware. The gap between the end-of-life announcement (2021 for the AK-SM 800) and the actual attack (2026) shows a dangerous lag in infrastructure upgrades. For entrepreneurs and business owners in the retail and logistics space, the lesson is clear: technical debt in OT is not just an IT problem—it is a business continuity risk that can lead to the physical loss of assets.

Global implications for US and UK enterprises

For business leaders in the USA and UK, this event serves as a critical warning regarding the management of Industrial Control Systems (ICS) and the Internet of Things (IoT). Many North American and British warehouses and retail hubs rely on similar legacy refrigeration and HVAC systems that may be just as exposed as those in France.

In the United States, while there is no single overarching 'AI Act' or equivalent strict OT mandate for private retail, the CISA (Cybersecurity & Infrastructure Security Agency) has repeatedly warned about the risks of legacy OT. Companies failing to secure these systems may face significant liability issues under negligence laws if a breach leads to public health crises or massive food waste. In the UK, the NIS (Network and Information Systems) Regulations place strict security requirements on operators of essential services, and while supermarkets may not always fall under the strictest 'essential' category, the trend is moving toward higher accountability for supply chain resilience.

The primary takeaway for international firms is the need for 'Air Gapping' or the use of secure VPNs for all OT maintenance. Allowing industrial controllers to be reachable via a public IP address is no longer a viable business practice. As AI-driven scanning tools make it easier for attackers to find these exposed devices globally, the window for updating legacy hardware is closing rapidly.

FAQ

Sources: Cybersecurity360, Redhotcyber, Ameve ·