France fridge hack: What UAE retailers should know about the cyber risks inside every supermarket?

Dubai: In an incident that has got many retailers questioning, hackers raised refrigeration temperatures to 50°C at about 150 Intermarché supermarkets in France, forcing retailers to discard large volumes of food. But this isn’t just another cyberattack, it has got retailers thinking about how secure their own systems are and how such vulnerabilities can be avoided.

The attack hit overnight on a weekend, when stores are empty and nobody watches temperature readings. Danfoss, which supplies the refrigeration controllers, confirms the affected units ran outdated firmware. Some were too old to receive updates at all. France’s cyber agency had already warned that management interfaces should not face the internet directly. 

Gulf News spoke with cybersecurity experts and learnt that the same class of equipment runs across UAE hypermarkets, cold stores and hospitals.

Mortada Ayad, Vice President of Sales for the Middle East, Turkey and Africa at Delinea, calls it an unconventional strike. Few expected anyone to target food supplies at this scale, he notes. Refrigeration may have been treated as a low-priority cyber target, which could explain the outdated firmware.

“Nobody can predict a zero-day vulnerability, but regular updates close known weaknesses,” he says.

Exposed management interfaces made matters worse. Criminals anywhere can find anything reachable from the internet.

Subhajeet Singha, Senior TRU Researcher at Acronis, urges caution on the exact entry point. Previously disclosed vulnerabilities should not be treated as the confirmed route without technical evidence, he cautions.

Connected refrigeration controllers and building management systems carry the most risk when three conditions meet, Singha outlines: old software, direct internet exposure and loosely controlled remote maintenance.

Ashok Chandrasekharan, Chief Operating Officer at ParamountAssure, points to an ownership gap. These systems usually sit with facilities teams, not security teams, so they fall outside the cyber programme. Equipment can also run for 15 to 20 years, long after vendor support ends.

“You can’t patch your way out of that,” he says.

Start with visibility. Singha recommends an inventory of controllers, sensors and building systems, covering software versions, support status and remote access details. Unsupported equipment needs a replacement plan.

Next, close the doors. Remove direct internet access and route maintenance through a secure gateway with multi-factor authentication. Ayad adds that contractors need named accounts limited to specific systems and time windows. “A supplier should not have a permanent key to everything,” he says.

Operational systems should also sit apart from corporate networks, payment systems and guest Wi-Fi. That limits how far an intruder can travel from one compromised controller.

Monitoring must cover physical settings too. Chandrasekharan cites a sudden jump from -20°C to +50°C as a trigger for investigation. Independent temperature alarms help store teams act before stock is lost.

Singha says there is a direct lesson for UAE retailers here. They should ensure that equipment that keeps stores running should be included in cybersecurity assessments. The test is how fast a retailer can detect interference, isolate equipment and keep stores safe. A refrigeration outage turns response time into a food safety issue.

The stakes also go beyond IT. The UAE imports most of its food, Chandrasekharan pointed out, that means cold chain integrity from ports to shelves should be counted as strategic national infrastructure. He wants operational technology and internet-of-things security requirements extended to cold chains and commercial buildings. He also calls for vendor accountability on remote access and joint drills between retailers, logistics operators and regulators.

There are financial implications as well from discarded stock, food safety checks and store disruption that amount to huge losses. Reports also indicate insurance policies may not cover this type of incident. That makes it a board-level business risk. Backups cannot reverse spoiled stock, which makes early detection essential.

Ayad simply puts the larger lesson to be learnt by telling retailers that every connected device and every supplier login should be treated as an identity with access to the business, so that access should be made secure before anything else.