Overnight on Sunday 11 October 2026, attackers remotely triggered the defrost function on refrigeration controllers at French supermarkets, and fresh food spoiled. The Record relayed BFMTV's estimate: about 300 Intermarché and Netto stores and fewer than 100 Coopérative U stores. Coopérative U chief executive Dominique Schelcher called the attack "unprecedented" and "unacceptable". Prime Minister Sébastien Lecornu asked ANSSI, France's national cybersecurity agency, to take up the case.
What is known, and what is not
BFMTV reported that the affected units are Danfoss refrigeration controllers running older software. Danfoss has not publicly confirmed that its systems were the target. Groupement Mousquetaires, which owns Intermarché and Netto, said the systems were managed by Danfoss and that any criminal complaint would be up to the supplier. The attacker, the method and the exact vulnerability have not been made public. Everything below is analysis of the policy gap, not a finding about this incident's cause.
The physical consequence is clear, though. This was not data theft. An attacker used a networked industrial device to destroy perishable goods across hundreds of sites in one night.
The case for tougher rules on retailers
The strongest argument for stricter obligations is that food supply is critical infrastructure in practice. A grocer that cannot keep products cold cannot sell them, and a coordinated hit on several chains at once can degrade supply for a whole region. Regulators who want mandatory risk management and fast incident reporting for large retailers are responding to a real systemic risk. They are not inventing a bureaucratic problem.
Europe has already built a framework for this. The NIS2 Directive requires medium and large entities in covered sectors to take cybersecurity risk-management measures and to notify national authorities of significant incidents. Member States had to transpose it by 17 October 2024. The Commission's page says it has referred France, along with Ireland, Spain and the Netherlands, to the Court of Justice for failing to notify its transposing measures.
France's transposition is still unfinished
France's own implementing vehicle is the draft "Résilience" bill. ANSSI's NIS2 page still describes it as a bill, with no adoption date given. On 17 March 2026 ANSSI released a working version of its ReCyF framework, which lists the measures it recommends to meet NIS2's security objectives. The framework is not mandatory by default, but entities that apply it can rely on it during an ANSSI audit.
This matters for the retailers' position. I have not verified whether Intermarché, Netto or Coopérative U would be covered entities under the French law once it passes. Even if they are, the law would fall on the stores' operators. In this incident those operators say the systems were managed by their supplier. Obligations on the retailer do not by themselves make the controller maker patch old software.
Where the leverage actually sits
The more promising instrument is aimed at manufacturers. The Cyber Resilience Act entered into force on 10 December 2024. Its reporting obligations for actively exploited vulnerabilities began on 11 September 2026, one month before this attack. Its main obligations, including security requirements across a product's design, development and maintenance and vulnerability handling over its lifecycle, apply from 11 December 2027.
That sequencing is uncomfortable. The first enforceable duty on manufacturers had only just started when the attack landed, while the broader security-by-design requirements are still more than a year away. Whether the CRA reporting duty reaches whatever vulnerability was used here depends on facts not yet public.
The warning signs were also public before Sunday. IT Wire reported in August 2026 that Claroty researchers found a hidden authentication mechanism (CVE-2025-41450) in the Danfoss AK-SM 800A. It could be abused to bypass authentication and reach remote code execution. Patched firmware (R4.3.1 or later) exists. The Record adds that Claroty counted more than 2,700 such devices exposed to the internet. It is not known whether those flaws were used in Sunday's attack. The pattern is still instructive: fixes exist, but they do not reach installed equipment that no one is clearly responsible for updating.
A proportionate response
The pro-innovation answer is not to pile new reporting forms on grocers. It has four parts:
- Put liability where control sits. When a supplier manages the device, the supplier should carry the patching and disclosure duty by contract and by law.
- Finish what is already enacted. France should pass its NIS2 transposition rather than invent a parallel food-security regime, and the CRA's lifecycle duties should be enforced as written.
- Make updates the default. Industrial devices should not sit on the open internet running old software, and vendors should ship maintained, patchable products.
- Share the post-mortem. ANSSI and its European counterparts should publish a technical account once the investigation allows, so other operators can check their own estates.
Overbroad rules would hit small shops and start-ups hardest and would add little security. Targeted accountability for those who build and manage the devices is cheaper and more effective. The French supermarkets lost a night's stock. The next target could be a hospital's cold chain.