Hackers target supermarket freezers in France: Could critical infrastructure be next?

Have we paid enough attention? We have been hearing the cybersecurity experts warning that the next major cyberattack may not begin with stolen passwords, ransomware demands, or leaked customer data. Instead, it could strike the physical systems that society relies upon every day. This week, that warning moved from theory to reality when hackers reportedly targeted refrigeration systems in hundreds of French supermarkets, causing food spoilage, operational disruption, and even fires.

The incident has become a stark reminder that cyberattacks are no longer confined to computer screens. They now have the potential to affect food supplies, public safety, and critical infrastructure.

According to reports, cybercriminals gained access to internet-connected refrigeration management systems used by major French retailers. By remotely manipulating controls, attackers reportedly forced refrigeration units into prolonged defrost cycles and raised temperatures to as much as 50°C (122°F). The result was catastrophic for affected stores. Fresh and frozen products were rendered unusable, refrigeration equipment was damaged, and some locations experienced fires linked to overheating systems.

What makes the attack particularly disturbing is not merely the financial loss. It is the target itself.

Traditionally, cybercriminals have sought money, sensitive information, or business secrets. In this case, the attack allegedly targeted systems responsible for preserving food. The objective appeared to be disruption rather than theft, demonstrating how digital attacks can directly impact physical operations and public services.

The attack has raised concerns across Europe because modern food supply chains are increasingly dependent on connected technology. From refrigeration units and warehouse sensors to logistics platforms and inventory systems, the journey from farm to supermarket is managed by a complex web of digital systems. When those systems are compromised, the consequences can spread far beyond a single organization.

Most of the operational technology (OT) in operation are legacy and they are forced to take part in internet of things mode (IoT) as converged to satisfy the demand of data exchange for operational performance monitoring or may be for reason, perhaps the most alarming lesson is that the technology involved was not particularly exotic. Reports indicate that some affected refrigeration controllers were older systems running outdated firmware and, in some cases, were accessible through the internet. Cybersecurity researchers and manufacturers had previously warned about vulnerabilities affecting such platforms.

This should concern every business leader.

Across industries, thousands of organizations operate internet-connected cameras, sensors, access control systems, HVAC equipment, industrial controllers, and smart building technologies. Many were installed for convenience and efficiency rather than security. Often overlooked by security teams, these devices can provide cybercriminals with a gateway into critical operations.

Just imagine a similar attack against hospital refrigeration units storing medicines, pharmaceutical manufacturing facilities, airport systems, data center cooling infrastructure, or food distribution warehouses. The consequences could extend far beyond financial loss, potentially affecting public health, safety, and national resilience. While this French incident involved supermarket refrigeration, it highlights a broader risk surrounding connected operational technology. This comparison is an analytical observation, not a reported outcome of the incident.

Recognizing the seriousness of the breach, French authorities launched investigations, while cybersecurity agencies urged organizations to limit internet exposure of affected systems and apply available security updates immediately.

Authorities of Agriculture and Food, warned that food security now requires greater cybersecurity attention, describing the exploitation of food-related systems as a growing reality.

The message emerging from France is clear that “cyberattacks are entering a new phase. The threat is no longer limited to data breaches and financial fraud. Attackers are increasingly capable of crossing the digital-physical divide, turning connected devices into instruments of disruption”.

For businesses, the lesson is urgent. Every internet-connected device, no matter how ordinary it appears, should be treated as a potential cyber risk. Security updates, network segmentation, asset inventories, and continuous monitoring are no longer technical best practices. They are essential safeguards for operational continuity.

The French freezer attack may ultimately be remembered as more than a cyber incident. It may be the moment the world realized that in a hyperconnected age, hackers do not need to steal data to cause damage. Sometimes, all they need to do is turn up the temperature.

Stay tuned for more expert interview on IT-OT-IoT convergence…

How do we protect our critical infrastructure?