French supermarket fridge cyberattack exposes basic security gaps, not AI

A cyberattack in mid-October 2026 let hackers remotely raise the temperature of refrigeration systems in hundreds of French supermarkets, including stores run by Intermarché and Carrefour. Retailers had to discard thawed food and spoiled milk. Who carried out the attack, and why, remains unknown.

The incident led many Europeans to ask whether months of warnings about advanced AI had finally materialised. Cybersecurity specialists say otherwise: the attackers most likely relied on conventional techniques to exploit devices that should never have been reachable from the internet.

Prime Minister Sébastien Lecornu personally oversaw the response, and the attack prompted coordination and information sharing at EU level. A security expert working with his office said the government held meetings to map other sectors that might be exposed, noting that vaccine storage during the ongoing flu campaign also depends on temperature control. No attacks on that sector have been recorded.

Old flaws, new speed

Security firm Claroty had previously found a software vulnerability in a product from Danfoss, one of the refrigeration makers targeted; Danfoss patched it in 2025. Illustrating how AI accelerates attacks, Claroty said it reproduced the original Danfoss flaws in 28 minutes for $6. French and German cyber authorities warned the attacks were probably continuing, and Greece's cyber agency reported hundreds of devices still online, though another research group found the number of exposed Danfoss devices had fallen sharply.

Notably, no extortion attempt has been reported. The attack came as Russia steps up hybrid warfare against Europe, and EU leaders have repeatedly warned Moscow could use cyberattacks to disrupt essential services. Supermarkets in the Netherlands and Belgium suffered unrelated, lower-impact cyber incidents the same week.

Back to fundamentals

The episode highlights a long-standing weakness in operational technology, the industrial equipment with physical outputs that is often old, poorly secured and needlessly connected. Rémi Enjolras, a chief technology officer at Cisco's Splunk, urged critical industries to stop treating AI "as a magical tool that will solve everything" and return to basics.

The EU has adopted laws meant to push critical operators and manufacturers toward stronger security, but France is among the countries lagging in implementing them nationally. The attack also lands while European food security is already strained by drought and disruption in the Strait of Hormuz.