Imagine running a supermarket and discovering that, overnight, the temperature in your freezers has reached 50°C. Thousands of euros worth of food are lost, equipment may be damaged, and some stores cannot operate normally. Your first reaction would probably be to call the refrigeration maintenance provider, investigate what went wrong and try to restore normal operations.
But what if the refrigeration systems had not failed? What if someone had deliberately changed their operating parameters remotely, through a cyberattack? And this is not a hypothetical scenario. In October 2026, hundreds of supermarkets across France experienced a major cyberattack targeting their refrigeration systems. Hackers remotely manipulated connected equipment, forcing freezers and cold-storage units into extended defrost cycles. In some locations, temperatures reached 50°C. Food had to be discarded, equipment was damaged and fires were reported. The attack affected several major retail networks, including Intermarché, Coopérative U, Carrefour, E.Leclerc and Monoprix. According to public reports, approximately 700 supermarkets were affected, although the precise number and impact varied between retailers.
Three weeks later, on 2 November, a similar wave of attacks affected retailers in several European countries, including Belgium, Sweden, Ireland, Estonia, Luxembourg and the Netherlands. Incidents were also reported in Germany and Romania. Among the affected businesses were Delhaize, Carrefour, Spar, ICA, Coop and SuperValu. IKEA also reported an affected location. In some stores, temperatures again reached 50°C, food had to be discarded and operations were disrupted.
The two episodes demonstrate how a vulnerability in an apparently ordinary piece of equipment can generate consequences far beyond the technical system itself. They also raise a more important question: What did retailers across Europe do with the information provided by the first incident in France?
1. An IT incident that became an operational crisis
At first glance, these incidents might be classified as cybersecurity events. However, looking at them exclusively through an IT risk perspective would miss most of the business consequences. The attackers did not need to access customer databases, payment systems or financial records. They targeted the technology controlling refrigeration equipment, which is essential to the daily operation of a supermarket.
Modern refrigeration systems are increasingly connected to remote monitoring and management platforms. These technologies allow retailers and maintenance providers to monitor temperatures, adjust operating parameters and identify technical problems without physically visiting every location.
Connectivity brings operational efficiency, but it also creates exposure. In the French incidents, vulnerabilities in remotely accessible refrigeration controllers allowed attackers to manipulate operating parameters. The consequences went beyond the disruption of a technical system: temperature increases compromised food safety, inventory was lost and stores faced operational difficulties.
The result was a chain of consequences: a cybersecurity vulnerability enabled unauthorised access to refrigeration controls; the manipulation of those controls disrupted the refrigeration process; temperature increases compromised the safety of fresh and frozen products; food inventory had to be withdrawn and destroyed; stores faced operational disruption, financial losses and potential reputational damage; equipment damage and reported fires introduced additional safety and recovery challenges.
This is a good example of how risks are interconnected and how an incident originating in one risk category can quickly spread across several others. Cyber risk became operational risk. Operational risk generated food safety risk. Food safety risk created financial and reputational exposure. In some cases, the incident also introduced physical safety risks. The consequences were not independent but connected through a chain of dependencies.
And refrigeration systems are certainly not the only assets exposed to this type of threat. Production lines, warehouse automation, energy distribution, water treatment, building management systems and access control infrastructure can all be affected by cyberattacks targeting operational technology. Refrigerators are simply a particularly relevant example because they illustrate, in a very tangible way, how a cyber incident can move beyond the digital environment and directly affect physical assets, products, people and business operations.
And, more important, the underlying vulnerability is not specific to supermarkets. It lies in the growing interconnection between IT infrastructure and the technologies that control the physical world and can affect ANY industry, increasing risks to an exponential pace, with very, very serious consequences.
2. The interdependence of risks is often underestimated
One of the fundamental challenges in Enterprise Risk Management is that organisations tend to identify, assess and manage risks within functional boundaries. IT manages cybersecurity. Operations manages equipment and store performance. Supply Chain manages inventory and deliveries. Quality manages food safety. Finance monitors financial exposure. Business Continuity coordinates the response to major disruptions.
Each function may have its own policies, procedures, controls and reporting mechanisms. But the business does not operate according to the organisational chart. The supermarket incidents illustrate at least five important interdependencies.
First, cyber risk and operational risk.
The attack was digital, but its immediate consequences were physical. A compromised controller did not simply generate an IT problem but it changed the operating conditions of equipment essential to the business. This is particularly relevant for organisations where Operational Technology (OT) is connected to IT networks or accessible through external service providers. The distinction between IT and OT matters because the latter controls physical processes. A cyber incident affecting OT can therefore interrupt production, damage equipment, compromise safety, prevent the delivery of essential services or, even worse, put lives of people or communities in danger.
Second, operational risk and supply chain risk.
A supermarket depends on the continuous availability of refrigeration, but also on frequent deliveries and reliable suppliers. If hundreds of stores lose their refrigerated inventory simultaneously, replacing the products is not simply a matter of placing new orders. Suppliers must have available stock. Distribution centres must have sufficient capacity. Transport must be organised. Deliveries must be prioritised. Stores must have the ability to receive and store replacement products. If the incident affects several retailers at the same time, the pressure on suppliers and logistics providers increases further. An event initially confined to individual stores can therefore become a supply chain disruption.
Third, operational risk and food safety.
Refrigeration is not just an operational convenience, it is a critical control in the food safety process. Once temperature limits are exceeded, the organisation must determine which products remain safe for consumption and which must be withdrawn or destroyed. This creates additional costs, regulatory exposure and potential reputational damage. Food safety requirements must take precedence over commercial considerations. Decisions about product withdrawal cannot be based simply on the apparent condition or value of the goods.
Fourth, operational risk and financial risk.
The financial impact extends well beyond the value of spoiled inventory. It can include equipment repairs, emergency maintenance, replacement purchases, lost sales, additional labour, transport costs, insurance deductibles, business interruption and potential contractual claims. There may also be longer-term consequences if customers lose confidence in the retailer's ability to maintain product quality and safety.
Finally, cyber risk and third-party risk.
Refrigeration systems are often installed, maintained and remotely monitored by external providers. The retailer may own the equipment, but the technology, software, connectivity and maintenance arrangements may involve several third parties. This creates a shared responsibility problem. Who ensures that controllers are updated? Who manages remote access? Who monitors vulnerabilities? Who is responsible for responding to an abnormal command? Who has the authority to disconnect a compromised system? If these responsibilities are not clearly defined, each party may assume that someone else is managing the exposure. Outsourcing the management of a system does not transfer the organisation's business risk.
The lesson is straightforward: managing each risk independently does not necessarily mean managing the overall business exposure.
3. The first incident should have changed the risk assessment
This brings us to the most important aspect of the story from an Enterprise Risk Management perspective. The first incident happened in France in October. The second wave followed on 2 November, affecting retailers across several European countries. Three weeks is a relatively short period, but it is not necessarily too short to learn, assess and implement at least some protective measures.
After the first incident, every retailer relying on remotely managed refrigeration systems should have reconsidered its exposure. A cyberattack targeting refrigeration equipment was no longer an abstract possibility or a theoretical scenario buried somewhere in a risk register. It had happened at scale, affected major competitors and demonstrated a clear potential for substantial financial and operational damage. For retailers using similar technologies or relying on comparable remote-access arrangements, the event should have triggered an immediate reassessment of both likelihood and impact.
In many organisations, this type of scenario should have moved towards the High Impact / High Probability category, at least as a temporary risk assessment pending further technical investigation. This does not mean that every retailer had the same probability of being attacked. Exposure depends on the equipment installed, software versions, network architecture, remote-access arrangements and the effectiveness of existing controls.
However, the first incident provided evidence that the threat was real, replicable and relevant to the sector. The probability assessment could no longer rely exclusively on historical internal incidents.
This is precisely where Enterprise Risk Management should add value. ERM should not be a static exercise in which risks are identified once a year, assigned scores and reviewed during periodic management meetings. It should be a continuous process of understanding changes in the internal and external environment and translating new information into management decisions.
An incident affecting a competitor can be as relevant to your risk profile as an incident affecting your own organisation. In fact, external incidents are often more valuable because they provide an opportunity to learn without having to pay the price of experiencing the event yourself.
4. Business Continuity: having a plan is not the same as being prepared
The second area where these incidents raise questions is Business Continuity Management. Most large retailers have some form of Business Continuity Plan (BCP). They may have plans covering IT outages, power failures, supply disruptions, natural disasters or the loss of critical facilities.
But having a plan does not necessarily mean being prepared for a particular scenario. A BCP developed around the assumption that ALL refrigeration equipment fails because of mechanical defects may not adequately address a deliberate cyberattack.
The distinction is important. A mechanical failure may affect one piece of equipment or one store. A cyberattack targeting remotely managed systems may affect dozens or hundreds of locations simultaneously. It may also compromise the monitoring and alarm mechanisms that would normally help detect the problem. This changes the assumptions behind the response.
Following the French incident, retailers should have reviewed their Business Impact Analysis (BIA) and asked some basic questions:
How many stores could be affected simultaneously?
How long can each store operate without functional refrigeration?
What is the maximum acceptable disruption before critical products must be discarded?
Are alternative refrigeration facilities available?
Can products be transferred to unaffected stores or distribution centres? Are maintenance providers able to respond simultaneously to multiple locations?
Can the organisation continue selling products that do not depend on refrigeration?
Who decides when products must be withdrawn and when a store must restrict its operations?
The response also requires clear responsibilities, escalation procedures, communication arrangements and access to the resources necessary to restore critical activities.
The second incident suggests that the threat remained relevant across the sector. Nevertheless, the recurrence of similar incidents demonstrates why Business Continuity plans must be regularly challenged against new scenarios rather than simply maintained as documentation.
5. Third-party risk cannot be outsourced
Another important lesson concerns the management of external providers. Retailers increasingly depend on specialised companies to install, maintain and remotely manage critical equipment. This arrangement makes economic and operational sense. It allows retailers to benefit from technical expertise and centralised monitoring without maintaining all the necessary capabilities internally.
However, outsourcing the management of a system does not transfer the organisation's business risk. A retailer remains exposed to the consequences of a failure or compromise, regardless of who operates the equipment.
This is why third-party risk management should go beyond contractual requirements and supplier assessments. Organisations should understand which critical systems are managed externally, how providers access them, what security controls are in place and how incidents are detected and escalated. They should also establish whether providers have sufficient capacity to respond to a simultaneous incident affecting multiple customers.
A maintenance provider may be perfectly capable of servicing individual stores under normal conditions but unable to respond quickly when hundreds of installations require intervention at the same time.
The provider's business continuity arrangements become part of the retailer's own resilience. This is not simply a cybersecurity issue, but a question of operational dependency.
6. Learning from incidents is one of the most valuable risk management activities
There is a tendency in many organisations to treat incidents affecting other companies as external news rather than management intelligence. The reasoning is often implicit: it happened to them, not to us. We use different systems. Our controls are adequate. We will deal with it if it happens.
This is an expensive way to manage risk.
External incidents provide an opportunity to understand how threats materialise, how vulnerabilities are exploited, what consequences follow and which controls may be ineffective. They also allow organisations to test assumptions without first experiencing the damage.
The supermarket attacks provided retailers across Europe with a remarkably clear warning. They identified a vulnerable area of operations, demonstrated the potential scale of disruption and exposed the interdependencies between cybersecurity, refrigeration, inventory, food safety, supply chains and financial performance. The information was publicly available. The technical vulnerabilities were being investigated. Industry participants and technology providers were discussing mitigation measures. The cost of learning from these events was relatively low compared with the potential cost of experiencing another attack.
This is where ERM and Business Continuity should demonstrate their value. ERM should translate external events into an updated understanding of the organisation's risk exposure, challenge existing assumptions and support decisions about priorities and resources. Business Continuity should translate that understanding into practical response and recovery capabilities. DRP, as part of the broader Business Continuity framework, should ensure that the technology supporting critical activities can be securely restored. And none of these disciplines should operate in isolation.
Conclusion: The best time to learn from a crisis is before it becomes yours
The supermarket refrigeration attacks are a typical example of how Enterprise Risk Management and Business Continuity can add value, and of how that value may be overlooked. But the lesson goes far beyond retail or refrigeration systems.
Any organisation relying on connected technologies to operate critical physical assets, deliver products or provide services may face similar exposure. The vulnerable asset may be a production line, a warehouse automation system, an energy installation or a building management system. The mechanism may differ, but the underlying risk interdependencies remain remarkably similar.
The first incident in France should have been a wake-up call for retailers across Europe. It was an opportunity to review risk assessments, challenge existing controls, reassess third-party dependencies, update Business Continuity scenarios and verify whether Disaster Recovery arrangements were adequate for a deliberate cyberattack affecting multiple locations simultaneously.
The second wave demonstrated that the threat had not disappeared.
Of course, no risk management framework can guarantee that an organisation will never experience a cyberattack. Nor can every incident be prevented. But there is a significant difference between being exposed to a risk that cannot be eliminated and being exposed to a risk that has already materialised elsewhere, without taking reasonable steps to learn from it.
The most valuable lessons in risk management are often those that other organisations have paid for.
They are also among the cheapest lessons to learn, provided that we understand their scope, recognise their implications and act on them in time. ERM is not about maintaining a risk register. Business Continuity is not about having a document on a shared drive. And Disaster Recovery is not simply about restoring IT systems. Their real value lies in helping organisations understand their dependencies, make better decisions and maintain or recover critical operations when disruption occurs.
