When Cyberattacks Shut Down Operations: What KRITIS Operators Can Learn from France’s Supermarket Attack
A cyberattack on refrigeration systems has brought operations at numerous French supermarkets to a standstill. The incident highlights just how vulnerable networked industrial control systems can be – and why up-to-date threat intelligence alone is not enough to ensure security.
A Cyberattack with Real-World Consequences
On October 12, 2026, the refrigeration systems of over 200 French supermarkets were compromised by a cyberattack. Among those affected were stores belonging to Intermarché and other retail chains. The attackers interfered with the control systems for automatic defrosting processes and changed temperature settings to as high as 50 °C. The consequences included disrupted cold chains, spoiled food, and significant economic damage.
Particularly noteworthy: Security vulnerabilities in the control systems of the affected manufacturer, Danfoss, were already known prior to the attack. Predictable usernames and insecure password handling are easy to exploit.
The incident highlights a fundamental problem: Cyberattacks are no longer limited to data and IT systems. They can directly manipulate physical processes and disrupt critical operations.
Known Vulnerabilities – Underestimated Risks?
Industrial control systems are increasingly networked. Remote maintenance access, external service providers, and digital interfaces enable more efficient operations but simultaneously create new points of vulnerability. Especially in critical infrastructure, security updates often cannot be deployed on short notice. Added to this are older systems for which manufacturer support has already expired.
The problem here is not always a lack of information.
Security agencies, research institutions, and manufacturers continuously publish information about new vulnerabilities, attack techniques, and security incidents.
The real challenge lies in identifying, from this flood of information, the risks that are actually relevant to one’s own organization. After all, not every critical vulnerability automatically poses a critical risk to every company.
Cyber Threat Intelligence: Turning Information into a Situational Picture
This is where cyber threat intelligence comes in. By continuously analyzing various information sources, current threats can be identified, assessed, and placed in an organizational context. The attack on French supermarkets is a good example of this.
For a grocery retailer, the affected refrigeration system controls may be of immediate relevance. For an energy provider, on the other hand, the focus may be on insights regarding inadequately protected OT systems, remote maintenance access, and the manipulation of industrial control processes.
The same event can pose completely different risks for different organizations.
A current cyber threat assessment should therefore not only provide information about which threats exist. It should also make it clear which of these are relevant to the organization itself and where action is needed.
The Right Information for the Right Decisions
A cyber situational awareness report only becomes useful when it leads to decisions. Different decision-makers have different information needs.
Senior management must understand the economic and operational risks involved. IT and OT management need technical information about affected systems, vulnerabilities, and appropriate protective measures. Information security officers must assess the implications for risk management and existing security measures.
Role-based situation reports can bring these different perspectives together and present relevant information in a targeted manner. This turns a technical security alert into a basis for decision-making.
Conclusion: It is crucial to act before the next attack
The dynamics of the attack on French supermarkets are striking: Since yesterday, we have been receiving reports of this incident from a wide variety of sources—a pattern that is also becoming increasingly visible in our CTI solution and that can result in significant economic damage.
For operators of critical infrastructure, the most important insight is therefore not limited to the technical protection of individual systems. What is crucial is to continuously monitor threats, assess their relevance to one’s own organization, and take appropriate action in a timely manner.
After all, more security information does not automatically mean greater security. What matters is translating the right information into concrete decisions at the right time.
