As soon as I finished publishing my take on this incident yesterday, people reached out to share their theories. “It was an AI that escaped its digital containment and went rogue,” said one researcher. Another suggested that an expatriate hacker gang with loose affiliations to a country known to harbor multiple APT groups was behind the attack. At the time of writing, we lack concrete evidence to prove either of these claims made by respected researchers who are otherwise not known to speculate.

Background

In a brazen cyberattack, hackers remotely took control of refrigeration systems in hundreds of supermarkets and independent stores across France in the early hours of Monday. The attack caused temperatures to soar as high as 50 degrees Celsius (122 degrees Fahrenheit) for nearly six hours, forcing stores to discard fresh and frozen food. The Intermarché supermarket chain reported damages costing “tens of millions of euros” in a single day.

This incident exposes a systemic risk in the retail technology supply chain: a common refrigeration-management platform, deployed across multiple independent retailers, can create a shared attack surface. Whether the incident involved a compromise of the supplier itself, the exploitation of exposed or vulnerable controllers, or another vector of access remains to be established.

Furthermore, it demonstrates how a compromise of connected operational technology can affect multiple businesses through a common technology dependency. Refrigeration controllers are not conventional IT endpoints; they directly influence physical processes. Unauthorized changes to their configuration can cause substantial financial losses, equipment damage, and potential safety consequences.

While we await the full scope of the investigation, it is important to understand the context of this incident. This was almost certainly a supply chain attack carried out to demonstrate an adventurous hacker group's capability to disrupt food-related retail operations. Consider the following evidence to back this claim:

·       Timing: The attack was carried out in the early hours of Monday rather than during a weekday evening or weekend morning. This indicates that the hackers sought a window that offered maximum impact with a lower chance of discovery. This was a well-planned and targeted operation.

·       Reconnaissance: The hackers demonstrated knowledge of vulnerabilities in older refrigeration management systems. They must have carried out at least one round of reconnaissance to lay the groundwork and calculate the attack window.

·       Absence of a Claim: The lack of a public claim points toward a newly established hacker group. Members may have previously worked for state-backed actors or APT groups, using this attack to build confidence and motivation to scale their destructive capabilities.

·       Recruitment and Signaling: Beyond announcing their arrival, the threat actor may leverage this incident to expand global recruitment operations.

·       Persistence: The attack lasted for six hours, suggesting the group was not merely operating out of a basement. In such a casual scenario, attackers would typically raise temperatures briefly, reset settings, and erase traces. Persisting for six hours demonstrates a high level of confidence and a desire to create a memorable incident.

·       State-Backed Linkages: While we cannot fully rule out connections to a state-backed hacker group, the timing—occurring well outside work hours early on Monday—suggests it may not have been a traditional APT operation. However, state-linked involvement cannot be confirmed or dismissed based on timing alone. Attribution requires corroborating evidence, including infrastructure overlaps, malware or tooling similarities, operational patterns, and intelligence from the ongoing investigation.

·       Rogue AI Bot Swarm: AI-assisted reconnaissance or automation remains a possibility, but there is currently no evidence establishing its use. Investigators must examine command patterns, tooling, decision-making behavior, and forensic artifacts before drawing such a conclusion.

I am confident that members of the threat group involved in this incident will be apprehended soon. The immediate priority is to preserve evidence, establish the attack path, identify other exposed systems, and reduce the risk of recurrence.

Five questions investigators should answer

·       Initial Access: Were the controllers accessible over the internet, reached through remote maintenance infrastructure, or accessed using compromised credentials?

·       Vulnerability Exploitation: Was a previously disclosed vulnerability exploited, and do forensic artifacts link the incident to a specific vulnerability or firmware version?

·       Scale and Coordination: Were commands issued centrally across multiple stores, or were individual controllers accessed separately? What evidence connects the affected sites?

·       Persistence and Detection: Were defrost settings changed once or repeatedly? Were alarms suppressed, delayed, misconfigured, or simply monitored ineffectively?

·       Safety and Recovery: Were independent temperature alarms, emergency shutdown procedures, manual overrides, and recovery controls effective? Could the attack have been contained without waiting for the refrigeration supplier?

The bigger challenge is how we learn from this incident and adopt security controls that help prevent such events. I have written about this in the detailed investigation available here.

To sum it up

The reported disruption to refrigeration operations across French supermarkets is a reminder that the consequences of a cyberattack cannot always be measured in encrypted files, compromised accounts or unavailable applications. In environments where digital systems influence physical processes, a cyber incident can rapidly become an operational and business-continuity problem. Refrigeration is a particularly clear example: prolonged loss of control or monitoring can threaten perishable inventory, disrupt store operations and distribution, and create equipment and safety risks that require immediate attention.

The incident also highlights an important distinction between what is observable and what remains unknown. Operational disruption may indicate that systems responsible for controlling or managing refrigeration have been affected, but it does not, by itself, establish how the attackers gained access, which components they manipulated, whether protective mechanisms were bypassed, or who was responsible. Until reliable technical evidence becomes available, these questions must remain open. Speculation about an attacker's identity or the use of a particular technology does little to help operators contain the impact or prevent a recurrence.

For retailers and other organisations operating connected physical infrastructure, the practical lesson is to treat refrigeration controls, building management systems, remote-access pathways and associated engineering workstations as part of the cybersecurity perimeter. These environments need appropriate network segmentation, tightly controlled remote access, continuous visibility into OT activity, secure configuration management and tested recovery procedures. Just as importantly, incident-response plans must account for the physical consequences of losing control or visibility and not simply the restoration of IT services. Where refrigeration is involved, this includes clear escalation procedures, equipment-level safety checks, temperature monitoring and documented criteria for safely resuming normal operations.

Ultimately, the resilience of a supermarket is not determined solely by the security of its corporate network. It also depends on whether critical physical processes can be protected, monitored and safely recovered when digital systems are compromised. The most useful response to this incident is therefore neither to speculate about an unconfirmed attack scenario nor to treat the disruption as an isolated IT failure. It is to examine the dependencies between enterprise IT, operational technology and frontline business operations and to ensure that a compromise in one environment cannot unnecessarily cascade into the others.