A Cyber Masterclass On Turning Cheese Into Fondue: Demystifying The French Supermarket Cyber Attacks

Cyber attackers are getting hungrier by the day – but not necessarily for organizations’ data or personal banking information. On October 12, hundreds of supermarkets across France opened their stores to spoilt produce after an overnight cyber attack caused fridges and freezers to reach temperatures of up to 50°C, with damage estimated at millions of euros. While the financial cost is significant, what might be more troubling is that the incident follows a series of attacks aimed at disrupting physical operations rather than stealing data. As firms digitize more of the physical world, this shift in attack objective will become risk leaders’ greatest blind spot if they overlook the security of mundane systems behind day-to-day operations.

Why cyber attacks are becoming common in the physical world

Humans have spent decades connecting and digitizing the physical world. Software allows supermarkets to monitor refrigeration across hundreds of stores remotely, reduce energy use and identify faults early. Building owners adopt unified building orchestration platforms (UBOP) to forecast electricity price spikes and dim lights in empty meeting rooms. Manufacturers use asset performance management (APM) software to forecast failures. These tools offer valuable, cost-saving data.

However, our expectation of these tools to keep running smoothly in the background has become a critical vulnerability, and attackers have learnt to exploit it. Investigations revealed that Danfoss, the Danish firm providing the French supermarkets’ refrigeration software, knew the affected units were older models with security systems that could not be updated to mitigate an identified risk. Visibility was therefore not the issue; rather, the cost, labour and time of replacing full units kept unsecured software in use. The expectation for operations to continue running day-to-day with unsecure software might have been realistic decades ago, but not in a world where AI-driven and autonomous cyber attacks are becoming more common. Firms must therefore become more diligent about securing and patching their digital systems, no matter how uncritical they might seem.

The incident also highlights a trend familiar from the AI world: liability is moving from vendors to users. Following the investigation, Danfoss noted that it had advised users to keep their systems’ security up to date. Vendors often ‘inform’ customers of known risks but rarely recall unsecured products. For businesses, therefore, third-party software is increasingly becoming an internal risk to manage.

What risk leaders can learn from the incident

Risk leaders must look beyond emails, financial databases and AI models to the unglamorous technologies their operations depend on. Organizations should:

• Ensure all systems and software, no matter how old, are patched and secure.
• Replace old systems that cannot receive security updates.
• Conduct frequent security risk assessments and update software as advised by vendors, with contingency plans for systems that cannot be updated.
• Invest in cyber risk intelligence to flag outstanding security updates.

These incidents show how the cyber attack agenda is broadening from financial gain to operational disruption and revenue loss. While regulatory pressures were the main driver of cybersecurity spend in 2026, CISOs will likely lean more into resilience-first ambitions in 2027 given these incidents (see Verdantix Global Corporate Survey 2026: CISO Priorities, Pressures And Preparedness). Ultimately, cyber risk is not becoming less digital; it is becoming more physical. It is about keeping buildings running, factories producing and fridges cold. And, for the French, about keeping the cheese from becoming fondue. For more risk insights, read our research: Enterprise Risk & Resilience - GRC Tech & Operational Resilience.