The recent cyber-attack targeting commercial refrigeration systems across hundreds of supermarkets in France has exposed a critical vulnerability in modern operational technology.

Rather than stealing data or executing ransomware, malicious actors simply compromised connected refrigeration controllers remotely – exploiting legacy equipment running outdated software and forcing them into continuous defrost modes.

This manipulation caused temperatures inside display units and cold rooms to spike dramatically, reaching up to 50°C in some locations and resulting in widespread food spoilage, operational disruption and even fires at some sites.

The incident highlights the severe physical consequences that can emerge when digital infrastructure is compromised. Reacting to the event, Paul Gooch, Deputy Departmental Head, Cyber & Enterprise Risk at Tokio Marine Kiln, told Tech Digest that the recent cyber-attacks impacting refrigeration systems across France should act as a wake-up call to those who underestimate the potential physical consequences of cyber incidents.

While the financial and operational threat of data breaches, ransomware attacks and network outages are now broadly understood and accepted, this event demonstrates how a compromised control system can lead directly to damaged stock, operational disruption as well as significant disposal costs.

Gooch also highlighted the severe insurance gaps exposed by such events, noting that for businesses that must maintain strict temperature and environmental controls for their inventory, the incident raises the question of whether their insurance would actually cover the loss of perishable stock. In most cases, traditional cyber and property policies contain exclusionary language for such scenarios, potentially leaving gaps in coverage.

Risk to UK retailers

Industry experts warn that these risks are not confined to France. Marijus Briedis, Chief Technology Officer at NordVPN, told Tech Digest that retailers in the UK and beyond could face similar threats if they rely on internet-connected refrigeration systems with matching vulnerabilities.

Briedis warned that the cyberattack on supermarket fridges in France should ring alarm bells in Britain, noting that if UK retailers use internet-connected refrigeration systems with similar security weaknesses, hackers could cause the same disruption here. There is no evidence British supermarkets have been affected by this incident, but distance offers little protection when criminals can reach vulnerable equipment remotely.

Briedis stressed that hackers don’t need to get into the tills to cause havoc in a supermarket, because interfering with the equipment keeping food cold means you can force stores to throw away valuable stock, shut entire aisles and leave shoppers facing empty fridges and freezers. A cyberattack can quickly become a food safety problem, as well as a very expensive one for retailers.

To mitigate these risks, he advised that British supermarkets should check their connected refrigeration systems now, especially older equipment that may no longer receive security updates, ensuring remote access is tightly controlled, critical systems are separated from the wider network and independent temperature alerts and manual checks are in place.

As threat actors increasingly target operational technology and vulnerable control systems, underwriters and corporations anticipate a structural shift toward specialist insurance solutions that specifically , business interruption and perishable goods loss.

For latest tech stories go to TechDigest.tv