An attack on supermarket cooling systems has exposed the physical risks of connected equipment, from spoiled food and damage to a difficult return to safe trading.

A cyberattack that disrupted supermarket refrigeration across France on October 12 has made an ordinarily invisible layer of retail technology a matter of physical safety. The immediate challenge is not simply getting computers working again. It is establishing that the equipment they control can be trusted.

Reuters reported that refrigerators were heated to as much as 50 degrees Celsius, causing spoilage and fires. Intermarche’s owner said about 150 stores were affected; Carrefour reported 80. Danfoss said affected equipment was running outdated firmware. French authorities opened an investigation.

The control system is part of the business

The incident illustrates a distinction set out in NIST’s guide to operational technology security: these systems interact with the physical environment, so their security must account for reliability, performance and safety. Building controls and environmental monitoring belong within that definition, not outside the security programme because they are neither office laptops nor payment terminals.

For a supermarket, that changes the meaning of an incident. The loss of a business application can interrupt a transaction; loss of trustworthy refrigeration control can affect the merchandise itself. Restoring availability is consequently only one condition for resuming normal operations. The physical process also needs verification by people qualified to assess it.

Claroty’s Team82 research, published in August, had examined Danfoss’s AK-SM 800A management platform and disclosed vulnerabilities that the manufacturer addressed through firmware updates. The platform brings monitoring, operating schedules, alarms and remote administration together. That research establishes a previously documented security concern; it does not by itself prove the precise intrusion sequence at every affected store this week.

A repaired console is not a completed recovery

The reporting has already moved beyond the first tally of affected shops. Le Monde’s October 13 account describes discarded stock, equipment damage and a replenishment effort expected to take days in some cases. It also reports Danfoss’s warning that many affected units were obsolete. The newspaper had seen no public claim of responsibility; attribution remains unresolved.

Recovery therefore has several separate gates. A store needs to establish what happened to its stock, whether its equipment remains serviceable and whether the management system can safely be reconnected. These are different decisions, potentially made by different specialists. Completing one should not automatically be treated as evidence that the others are complete.

The same distinction applies to evidence. A working controller after a reset does not explain how its configuration was changed beforehand. Conversely, an investigation into the digital entry point cannot replace inspection of equipment that may have been damaged. A response organised around only one of those questions risks losing either operational assurance or the ability to understand the cause.

Responsibility cannot stop at the contractor boundary

Remote maintenance creates a practical governance question: who is accountable for the security condition of the system throughout its life? A retailer may buy equipment, appoint a servicing company and rely on manufacturer updates, yet none of those arrangements alone demonstrates that an update reached each installation or that access was restricted appropriately.

A useful management review would trace that chain of responsibility from procurement to retirement. It should ask who inventories controllers, who authorises changes and who records whether a unit remains supported. The objective is not to presume that one contractor caused the French attack, but to prevent responsibility disappearing between organisations when a safety-relevant device is treated as somebody else’s technology.

There is an important investment trade-off here. Replacing unsupported equipment costs money and may interrupt service. Continuing to use it can preserve short-term convenience while leaving a risk that is harder to remedy during an emergency. That decision deserves explicit ownership rather than being made by default each time a replacement is postponed.

The test is trustworthy operation

The broader lesson is about the boundary of cyber resilience. A retailer’s security picture is incomplete if it covers customer records and tills but omits the controls that preserve the goods being sold. The consequences of a compromise can remain on the shelves, in the storeroom and in the repair bill after the network incident appears contained.

The next meaningful milestone is not merely a statement that systems are online. It is a defensible account of safe equipment, controlled access and completed recovery decisions. The French attack has made that distinction impossible to dismiss as a technical detail.