Thirteen years apart, two highly publicised cyber attacks on supermarkets started in the same unlikely place: the cold aisle. One was about cardholder data theft, the other was about causing significant disruption.
The story behind both is remarkably similar, and it is one every business should be reminded of.
The Week When Fridges Turned into Cookers
Overnight on Sunday 11 October 2026, cyber criminals took control of refrigeration systems in supermarkets across France. By the time staff arrived the following morning, freezers had warmed, stock had spoiled, and some stores were dealing with flooding from sprinklers or damage from fires.
Weaponising food is becoming increasingly popular amongst threat actors.
The attackers had taken remote control of the systems that controls supermarket refrigeration units, and turned the temperature up to 50°C. Around 700 stores were affected, including branches of some of France’s best known chains. The contents of the affected fridges and freezers were disposed of, and one chain alone estimated the losses at tens of millions of euros in a single day.
2013: The Fridge Contractor Who Opened the Door for Attackers
Rewind to late 2013, and the American retailer giant Target suffered what was then one of the largest data breaches in history. Card details belonging to around 40 million customers were stolen during the busy Christmas shopping season.
Criminals did not break in through Target’s front door. They broke in using the login details of a small refrigeration and air conditioning contractor that worked on Target’s stores. That contractor had a perfectly legitimate reason to connect to Target’s systems, for things like maintenance and temperature control management. However criminals were able to access far beyond where the contractor ever needed to go, all the way to the tills where customers made payments.
The Same Story, Told Twice
Look past the headlines and these two attacks share a very similar plot.
The fridge was nobody’s priority. Refrigeration is something most businesses think of as plumbing, not as a security risk. It sits with the facilities team or an outside contractor, well away from the boardroom’s view of cyber risk. In both cases, that blind spot was exactly where the attackers went.
Third party access became the way in which exists for good reason, saving time and money, but both were left without enough protection.
In both cases, something that once seemed harmless quietly became a major threat.
The damage went far beyond the fridge. Neither attack was really about refrigeration. At Target, it was a route to customer payments and a reputational crisis that cost the chief executive his job. In France, it was maximum damage causing empty shelves, lost stock, fires, water damage from sprinkler systems and shaken public confidence in the food supply.
What has Changed, and What Hasn’t
The difference between the two attacks is just as telling. In 2013, the goal was to steal information. In 2026, the goal appears to have been to cause physical, real world disruption. Cyber attacks are no longer only about data. They can now spoil stock, stop operations and put premises at risk.
What has not changed is the lesson. Thirteen years on, the weakest point is still often the thing nobody thinks to protect.
Four Questions to Ask in Your Own Business
You do not need to run a supermarket for this to matter. Most organisations now have equipment that connects to the internet and suppliers who connect to their systems. Ask yourself:
1
Do we have sight of our attack surface, especially anything which connects to the internet, from heating and alarms to cameras and printers?
2
Do our suppliers have more access than they actually need, and do we remove it when the work is done?
3
Is any of our equipment end of life that the manufacturer no longer supports?
4
If an attack stopped our operations tomorrow, rather than stealing our data, do we have a plan?
If any of those questions gave you pause, you are not alone, and it is far easier to address now than after the fact.
Our friendly team are happy to talk with you.