For years, people have associated cyberattacks with stolen data, locked computers and disrupted digital services. However, the incident that affected numerous French supermarkets during the night of 11–12 October 2026 shows that a breach can have consequences beyond the digital world.
This time, the attackers did not primarily target tills, payment systems or customer databases. Their target was the connected infrastructure used to regulate food refrigeration across different stores.
According to published reports, the cybercriminals gained remote access to controllers manufactured by Danfoss and altered their operation. In some stores, prolonged defrosting cycles were reportedly activated and temperature settings were modified, reaching as high as 50°C in certain cases.
The resulting break in the cold chain forced the affected supermarkets to remove large quantities of fresh and frozen products. Some stores had to temporarily close sales areas or suspend part of their operations while they inspected the equipment and disposed of the affected goods. The total financial impact is not yet known, but initial assessments suggest losses running into millions of euros.
This incident is particularly significant because it clearly shows how a digital vulnerability can directly affect products, facilities and physical processes.
The attack did not target data. It targeted a process
The most striking aspect of this case is that the cybercriminals did not need to access banking information or steal a database to cause considerable damage.
Compromising a system responsible for controlling a critical physical process was enough.
“This incident is a very clear example of how a vulnerability in connected systems can have direct consequences in the physical world. The attackers did not need to target bank accounts or databases. Compromising industrial control systems was enough to cause significant financial losses and disrupt the operations of numerous stores.”
Commercial refrigeration systems can be monitored and adjusted remotely. This connectivity facilitates maintenance, fault detection and energy optimisation. However, it also expands the attack surface when the equipment is not properly secured.
Available reports indicate that the incident may have affected obsolete models or equipment that lacked necessary updates. Reports also point to administration consoles that exposed systems to the Internet. However, investigators must still determine exactly how the attackers gained initial access and which specific configurations they exploited.
Caution is therefore essential. We do not yet know all the technical details of the incident. Until the authorities and the companies involved publish their conclusions, it would be premature to state exactly how the attackers gained access or to attribute the operation to a particular actor.
The most useful question at this stage is not who was behind the attack, but why systems capable of controlling physical processes offered attackers opportunities for remote access.
The convergence of IT and OT environments
The incident highlights the growing convergence between traditional information technology, or IT, and operational technology, or OT, used to control machinery, facilities and physical processes.
This connection provides enormous benefits. It enables organisations to manage equipment remotely, automate tasks, anticipate faults, monitor energy consumption and improve operational efficiency.
However, every connected device also becomes an asset that must be identified, updated, monitored and protected.
“Cybersecurity no longer affects only data or traditional IT systems. Today, any connected infrastructure, including industrial and refrigeration systems, can become a target. Protecting operational environments must be treated as a strategic priority to safeguard business continuity and supply chain security.”
An industrial controller should not be treated as a secondary device simply because it does not store customer information. If it manages a cold room, production line, climate-control system or supply facility, its compromise could halt operations, destroy goods or disrupt an essential service.
The importance of an asset is determined not only by the information it contains, but also by the process it controls.
A warning for every industry
Although this incident occurred in the food retail sector, its lessons extend far beyond supermarkets.
Hospitals, factories, energy providers, transport companies, logistics centres and water treatment facilities all rely on connected systems to manage physical processes. In each of these environments, an insecure configuration, poorly protected remote access or an outdated device can become an entry point.
Causing a significant impact on critical or sensitive infrastructure does not always require an extremely sophisticated attack. A controller exposed to the Internet, weak credentials, insufficiently protected remote access or poor segmentation between IT and OT networks can open the door to serious operational consequences.
This case should not be regarded solely as an isolated problem affecting a group of supermarkets. It is a warning for every organisation that has connected to the Internet systems originally designed to operate in isolation.
Digital transformation is not simply about connecting more equipment. It also requires organisations to understand the risks that emerge when those devices can receive instructions from outside the organisation.
Business continuity also depends on cybersecurity
When we discuss business continuity, we tend to think about backups, redundant servers and plans for recovering information. All of these remain essential, but they are not enough when an attack affects physical systems.
A backup may help restore a configuration, but it cannot recover food that has been exposed to unsafe temperatures. Nor can it resolve the logistical consequences of emptying entire cold rooms and refrigerated displays.
Business continuity plans must therefore consider scenarios in which a digital intrusion directly alters operations. Organisations need to know which processes depend on connected systems, how to detect abnormal behaviour quickly and what alternatives are available if those systems become unavailable.
“The most striking aspect of this case is that the cybercriminals did not attack information. They attacked physical infrastructure. It clearly demonstrates that cybersecurity now has a direct impact on economic activity, product availability and the continuity of essential services.”
Cybersecurity is no longer an exclusively technical function. It is an operational, financial and strategic issue that must form part of business decision-making.
How to reduce the exposure of industrial systems
No single measure can prevent every incident. Protecting industrial environments requires a combination of prevention, monitoring and response capabilities.
Maintain an up-to-date asset inventory
An organisation must know which devices it has, which processes they control, which versions they use and who is responsible for maintaining them. It is impossible to protect an asset properly if its existence or configuration is unknown.
Update or replace obsolete systems
Older equipment may continue to perform its operational function, but that does not necessarily mean it remains secure. When a manufacturer no longer provides support or security updates, the organisation must consider replacing the equipment or applying compensating controls to reduce its exposure.
Limit direct exposure to the Internet
Industrial systems should not be publicly accessible unless there is a genuine operational requirement and appropriate controls are in place. Where remote access is necessary, it must be restricted, authenticated, monitored and limited to authorised users and equipment.
Segment IT and OT networks
Corporate networks and operational systems should not share an environment without appropriate separation. Effective segmentation makes it more difficult for an attacker who compromises a conventional IT device to move towards systems that control physical processes.
Strengthen privileged access controls
Accounts that can modify temperatures, stop equipment or change configurations require additional controls. The principle of least privilege should also apply to suppliers, maintenance engineers and external service providers.
Monitor equipment behaviour
It is not enough to know whether a controller is online or offline. Organisations must be able to identify configuration changes, unusual access attempts, temperature changes outside expected ranges and other signals that could indicate manipulation.
Prepare an OT-specific incident response
The organisation must define who makes decisions when it detects abnormal behaviour. It must also establish how to isolate the affected device and maintain operations manually or through an alternative process. Security, maintenance, operations, management and external suppliers must also coordinate their response.
Digital transformation requires security by design
This does not mean rejecting connectivity or returning to entirely manual operations. Digitalisation improves efficiency, reduces costs and enables organisations to anticipate many operational problems.
The challenge is to avoid treating cybersecurity as a layer added at the end.
When a connected device controls a critical function, teams must consider its security from the design stage. They must maintain security throughout the device’s lifecycle and reassess it whenever its configuration or level of exposure changes.
“The main lesson from this attack is that digital transformation must be accompanied by a robust cybersecurity strategy. Keeping systems up to date, limiting their exposure to the Internet and continuously monitoring critical assets are essential measures for reducing the risk of this type of incident.”
The connection between the digital and physical worlds is now irreversible. That is precisely why we must stop thinking that a cyberattack can only erase data or lock a screen.
It can also increase the temperature of a cold room, halt a production line, interrupt a service or disrupt an entire supply chain.
The question organisations must ask is not only whether their data is protected. They must also understand which physical processes depend on connected systems and what would happen if someone managed to manipulate them.
