French supermarket chains said attackers took remote control of refrigeration systems in hundreds of stores and raised temperatures sharply overnight, causing food losses and operational disruption. According to the reported details, the attackers accessed the systems through remotely managed Danfoss controllers used to run fridges and freezers in stores.

What happened

Several French retail chains said the incident took place during the night of October 11. Attackers reportedly gained access to the controller that manages a store’s refrigeration equipment and increased temperatures, in some cases to levels that made stored food unusable.

The reported entry point was a connected control device made by Danfoss, a Danish company whose equipment can be managed remotely by maintenance providers. Based on the information available, the published report describes disruption and product spoilage, but does not establish broader technical details such as the precise intrusion method, whether credentials were compromised, or whether a software vulnerability was involved.

Why it matters for European businesses

This incident is a clear example of how cyber risk now extends beyond office systems and cloud software into operational technology used in day-to-day business operations. For retailers, food businesses and other companies that rely on connected equipment, a cyberattack can create immediate physical and financial consequences even when no customer-facing website or corporate IT system is directly targeted.

For European businesses, the practical significance is broad:

• Business continuity: A compromise of connected equipment can stop or disrupt trading overnight.
• Inventory loss: Temperature-sensitive stock may need to be discarded, creating direct financial damage.
• Safety and compliance implications: In food retail and other regulated sectors, equipment failures can trigger safety, quality and reporting issues.
• Third-party risk: Remote access by service providers can become a security weak point if not tightly controlled.
• Operational technology exposure: Building systems, refrigeration, HVAC, industrial controls and similar assets are increasingly connected and therefore attractive targets.

The case also matters beyond supermarkets. Many SMEs across Europe now depend on internet-connected devices for storage, energy management, access control, manufacturing, healthcare, logistics and facilities management. If those systems are remotely administered, they may sit outside traditional IT security processes even though they can directly affect revenue and operations.

Who may be affected

• Food retailers and supermarkets using connected refrigeration and freezer management systems.
• E-commerce and logistics businesses handling temperature-sensitive goods in storage or transport.
• Hospitality, healthcare and pharmacy operators relying on controlled-temperature environments.
• Facilities and IT teams responsible for building management systems, sensors and remote monitoring platforms.
• Companies working with external maintenance providers that have remote access to operational systems.

What companies should consider

While the available reporting does not yet confirm the exact technical cause, the incident offers a practical checklist for businesses that operate connected physical systems:

• Map connected operational assets: Identify refrigeration, HVAC, access control, industrial control and other remotely managed systems across locations.
• Review remote access paths: Check which vendors, maintenance firms and internal teams can access these systems, and how authentication is handled.
• Reduce third-party access where possible: Limit always-on connections, remove unused accounts and apply least-privilege access.
• Segment operational technology from core IT: Keep building and equipment control systems separated from business networks where practical.
• Monitor for unusual changes: Set alerts for temperature spikes, controller setting changes and out-of-hours access activity.
• Confirm incident response procedures: Ensure store operations, IT, facilities and suppliers know how to isolate affected systems quickly.
• Assess vendor security posture: Ask suppliers and maintenance partners about authentication controls, logging, patching and remote support security.
• Prepare continuity plans: For businesses with perishable or regulated stock, define actions for stock checks, spoilage response and service restoration.

For European SMEs, the broader lesson is that cybersecurity is no longer limited to laptops, email and SaaS platforms. Any internet-connected system that can alter physical operations should be treated as part of the company’s cyber risk surface.