Attackers took over the software controlling supermarket refrigeration in France and made the cold rooms warm up and stay warm. Physical damage in the food chain, with no data theft.
The numbers, per the BBC: about 400 of 15,000 stores affected, with Intermarché and Netto totaling 180 stores plus 100 disconnected in a hurry. Coopérative U lost over 100, Carrefour 80 of 6,000, and Monoprix 5%. The cold rooms sat at 50 degrees for six hours overnight. Two stores in Alsace lost 270,000 euros combined, and the national total is expected in the millions.
The detail that changes the risk category
Access came through Danfoss’s remote refrigeration software. And the interesting sentence is the one the BBC attributes to the company: the affected units were old models whose security update was not possible against an already-identified risk.
No alert was missing: the correction path for the equipment in use was. The risk had been identified, the patch did not exist for the model, and the asset stayed on, with remote control exposed, because the operation depended on it.
The cold chain had been warned
It is not the category’s first case: the Nichirei attack that stopped KFC’s chain in Japan and the Fairlife case, from the Coca-Cola group, with Anubis drew the mechanics in the global cold chain. The French case’s difference is degree: not even ransomware was needed. The equipment’s remote control sufficed for physical damage.
And the institutional response rose a level: European Food Commissioner Christophe Hansen registered that using food as a weapon became reality, and the Paris prosecutor’s office opened a cybercrime investigation calling the case a large-scale attack on major food chains’ refrigeration.
The audit the case imposes
The question is one and applies to industry, retail, healthcare, and logistics: how much of your operational fleet runs on a model the manufacturer itself cannot update?
That list, not the antivirus alert list, is what determines where the next incident will be born. For each item on it, the design is compensation: network segmentation, VPN for remote access, local alarms independent of the software, thermal failsafe on the equipment, and a response plan including physical damage, with the operations team rehearsing alongside IT.
Conclusion
The French case is ransomware without ransomware: no encryption, no data theft, no demand. Just the control of a forgotten device on an unpatchable model, pointed at physical damage.
The cold chain was warned three times (Nichirei, Fairlife, now France), and each response applies to the next: the fleet that receives no patches exists in every operation, and inventorying it is the work preceding any firewall. The next case will be born on the list your operation has not made yet.