A cyberattack that remotely altered the temperature settings of hundreds of supermarket refrigerators in France has exposed vulnerabilities in Europe’s food supply chain, highlighting the importance of basic cybersecurity measures rather than the more speculative risks associated with advanced artificial intelligence.
The attack last week forced retailers, including Intermarché and Carrefour, to discard food that had defrosted or spoiled after refrigeration systems were compromised. The perpetrators and their motives remain unknown.
Cybersecurity experts described the incident as an example of how relatively unsophisticated digital attacks can disrupt essential services and cause tangible damage. Ferdinand Gehringer, hybrid threats lead at FTI Consulting, called it a typical case of cyber-enabled sabotage affecting supplies vital to society.
French Prime Minister Sébastien Lecornu personally oversaw the response, while the incident prompted coordination and information-sharing at the European Union level.
A cybersecurity expert working with Lecornu’s office said the French government had also begun examining whether other sectors could be affected. Particular attention has been paid to systems that rely on precise temperature controls, including those used to store vaccines. No attacks targeting vaccine storage systems have been reported.
Unrelated cyber incidents affecting supermarkets in the Netherlands and Belgium during the same week also highlighted the food sector’s dependence on information technology and networked systems, Dutch Food Security Minister Silvio Erkens told POLITICO.
Outdated technology and exposed devices
Experts said the French attack most likely relied on traditional hacking techniques to exploit devices unnecessarily exposed to the internet, rather than sophisticated artificial intelligence.
Amir Preminger, chief technology officer at cybersecurity firm Claroty, described connecting industrial devices directly to the internet without adequate protection as an outdated and unsafe practice.
Claroty had previously identified a software vulnerability in a refrigeration controller manufactured by Danfoss, one of the companies whose products were targeted in the French incidents. Danfoss fixed that flaw in 2025, although experts warned that other exposed devices could remain vulnerable.
French and German cybersecurity authorities warned that attacks might still be ongoing. Greece’s cyber agency and cybersecurity monitoring organizations also reported that hundreds of industrial devices remained accessible online, although not all were necessarily vulnerable.
Researchers said the number of exposed Danfoss devices had declined, but the wider problem of insufficiently protected industrial technology remains unresolved.
Food supply chains under pressure
The cyberattack comes as Europe’s food security faces additional challenges from geopolitical instability and climate change. Disruptions affecting the Strait of Hormuz have placed upward pressure on fuel and fertilizer costs, while drought and other extreme weather conditions have affected agricultural production. Disruptions in the Black Sea region have also contributed to pressure on global food markets.
Else Groen, director general of the trade association Independent Retail Europe, said attacks on food systems were a serious concern. However, she stressed that the resilience of food supply chains reduces the likelihood that incidents of this kind will threaten the overall availability of food to consumers.
For retailers operating on narrow profit margins, the loss of large quantities of refrigerated goods can nevertheless represent a substantial financial blow.
The incident has renewed attention on operational technology — industrial equipment that produces physical effects, such as refrigeration, heating and manufacturing systems. Many such devices are old, poorly secured or connected to the internet without sufficient safeguards, despite the consequences that tampering with them can have.
AI could accelerate cyberattacks
Although experts believe traditional methods were likely used in the French case, artificial intelligence is making it easier and faster to reproduce certain cyberattacks.
Claroty said it was able to reproduce the vulnerabilities in Danfoss products in 28 minutes at a cost of $6, illustrating how quickly some weaknesses can be identified and exploited.
AI tools can help attackers discover software flaws, automate tasks and target multiple organizations more efficiently. Cybercriminals who already use extortion and disruption against businesses and hospitals could potentially apply these capabilities to a wider range of essential services.
The motive behind the French supermarket attack remains unclear, and authorities have not established who was responsible. The incident occurred amid wider European concerns about Russia’s hybrid warfare campaign, including warnings from European officials that cyberattacks could be used to disrupt critical infrastructure. However, no attribution of the supermarket attack to Russia was established in the report.
Experts also stressed the importance of distinguishing the risks posed by people using AI to conduct attacks from hypothetical scenarios in which advanced AI systems independently act against humanity.
European cybersecurity teams are increasingly using AI to strengthen digital defenses, but specialists warn that the technology cannot replace fundamental security practices.
Rémi Enjolras, a chief technology officer at Splunk, part of Cisco, said critical industries should stop treating AI as a universal solution and return to basic cybersecurity measures.
The EU has adopted legislation intended to improve security standards for critical industries and technology manufacturers, but implementation remains uneven. France, for example, has fallen behind in implementing some national regulations, while companies face limited incentives to undertake costly security upgrades.
The images of empty supermarket refrigerators may now provide a powerful reason to address those weaknesses.
“It should serve as a kind of a wake-up call,” Enjolras said.
