I woke up this morning for the opening day of Singapore International Cyber Week, where I am speaking at GovWare on October 15th, to the news that hackers had infiltrated the cooling systems at hundreds of supermarkets throughout France, resulting in fires (according to the Paris prosecutor's office) and spoiled foods estimated to be worth millions of euros. Reportedly, hackers gained control of the software provided by Danish engineering firm Danfoss that regulates the temperature of the refrigeration units, forcing some to warm to as much as 122°F overnight. As of this writing, there are no claims of responsibility or motivations for the attack that hit the French supermarkets while the country is reeling from nationwide student protests over schooling conditions and systemic inequality. Here are my reflections on this latest cyberattack:
In the age of AI, attackers still exploit basic weaknesses
Initial reporting suggests that the attackers targeted older versions of Danfoss control software. Danfoss told AFP that most of the affected units are older AK-SM800 and AK-SC355 models that no longer receive software or security updates, and that one AK-SM800 version was running outdated firmware. France's cybersecurity agency, ANSSI, has identified a vulnerability in Danfoss software, but the specific flaw has not been made public. Vulnerabilities in the newer AK-SM 800A line were disclosed and fixed in 2025. In a statement, Danfoss said that it had "long advised" customers to keep systems up to date.
In 2026, it is amazing to me that vulnerability exploitation is still the number one-way breaches start (in Verizon's 2026 Data Breach Investigations Report, 31% of breaches, up from 20% a year earlier). In my experience, this happens because firms do not employ enough cybersecurity professionals who can defend against both information technology and operational technology (like the equipment exposed in the supermarket hack) attacks. In addition, firms can be reluctant to patch for fear of disruption to operational systems or due to the costs of the underlying upgrades. A further question is how the attackers reached these systems. The entry route has not been made public, so whether the weak point was exposed controllers, a known vulnerability, or a contractor's remote access remains an open question.
Recovering from the attack will likely cost more than updating systems would have
Although damage is still being assessed, some stores have already reported costs of hundreds of thousands of euros, and given the scale of the attack, it would not be surprising if the total cost reaches tens of millions of euros. This would seem to suggest that patching or replacing legacy systems and firmware would likely have been cheaper than dealing with such a catastrophic attack. This, of course, is easier said than done for the grocery industry that is notoriously low margin.
Was the attack connected to the protest movement, geopolitical events, or something else?
As of this writing, there have been no reports of attribution or motivations in the attack. The timing is notable in that the cyberattack occurred in the middle of these protests, but there is no evidence of a link, and it would seem strange if someone aligned to the protest movement would attack food retailers, thus jeopardizing the protesters themselves. It is possible that the attack was part of the broader Russian-linked hybrid warfare campaign occurring against European nations. Such an attack would likely not breach the threshold of an act of war, but is obviously disruptive and dangerous. I would add that it is interesting that there have been no early reports of ransomware demands, which may suggest that organized crime was not involved.
Vulnerabilities in newer Danfoss controllers were disclosed and fixed in 2025
Vulnerabilities in Danfoss's newer AK-SM 800A refrigeration controllers were found by security firm Claroty and fixed by Danfoss in 2025, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published an advisory in May 2025. Claroty reported publicly on its full findings in August 2026 and advised customers to upgrade to the latest firmware provided by Danfoss. It has not been established that these are the flaws used in this attack. Danfoss says most of the units hit in France were older AK-SM800 and AK-SC355 models that no longer receive updates. Whatever the entry point, responsibility for keeping these systems secure is shared among manufacturers, retailers and the maintenance contractors who manage them.
What this means for EU policy
EU Commissioner Christophe Hansen has already warned that "food security requires more attention at all levels." This is the kind of incident the EU's new cyber rules were written for. Under the Cyber Resilience Act, manufacturers must report actively exploited vulnerabilities in their products, and those reporting obligations began to apply on September 11, 2026, including for products already on the market. NIS2 covers food businesses engaged in wholesale distribution and industrial production and processing, so retailers may fall in scope through their wholesale or logistics operations, depending on size and national transposition. Neither framework fully solves the problem of unsupported operational technology that is already installed. The CRA's design and update-support requirements apply only to products placed on the market from December 2027.
So much wasted food
It pains me to see the sheer amount of wasted food involved in this attack. The absence of a ransom demand or a claim of responsibility so far does not tell us who was behind the attack. The attackers appear to have wanted to maximize harm, which is consistent with a state actor, a hacktivist group, or a criminal group that has not yet made contact. If the reported spread beyond France is confirmed, it would suggest a campaign aimed at a maximum destruction and geopolitical dimensions. Either way, it raises the question: what sector could be targeted next? Similar controllers appear to be used in pharmaceutical cold storage and warehouses and food plants where a failure could be even more consequential.