Picture your leadership meeting three weeks ago. A headline lands on the table: hackers took over the refrigeration in about 700 French supermarkets and spoiled their food overnight. You ask, “Could that happen to us?” Your team says they’ll look into it. You move on to the next item, and nobody brings it up again.
On November 2, attackers changed the refrigeration setting at supermarkets and small shops in nine European countries, warming fridges and freezers until food had to be thrown out. Sound familiar? It’s the same kind of attack that hit France three weeks earlier, on the same kind of equipment, using the same kind of weakness. The fix had been public eve since. No one knows yet whether the same attackers were behind both, but everyone running this equipment had been warned.
Here’s what should get every executive’s attention: after a public warning, getting hit isn’t bad luck anymore. It’s a question about what you did with the warning. And where the details are known, the businesses that got hit were ones that hadn’t followed through.
The difference wasn’t technology
In the Netherlands, Danfoss said most shops secured their systems after France. The few that didn’t were the ones attacked, still running default passwords. In Estonia, the one store hit was the last location the chain hadn’t yet moved to a new system. In Belgium, a refrigeration contractor told its customers to lock down their connections. Most did. Some didn’t.
It wasn’t just big chains, either. Butchers and corner shops were hit too, and one Belgian butcher lost about €15,000 in meat.
None of these businesses lacked information. They lacked follow-through. And none of it took a sophisticated attacker. Default passwords on equipment anyone can reach from the internet just takes someone willing to look. Bad guys don’t hack in, they log in.
Three things this tells you about your own company
“We took care of it” isn’t an answer. Plenty of leadership teams asked the right question after France. Fewer asked the second one: how do we know? A fix nobody has checked is still an assumption, and attackers don’t care what’s on your to-do list.
Your risk doesn’t stop where your network does. Several affected stores ran equipment installed and managed by outside suppliers, on networks separate from the company’s own. One chain said its systems weren’t affected, because the stores that were hit sat outside its central network. Technically true. It didn’t save the food. If a vendor installed it at your site, it’s your problem when it fails.
The last site on the list is the one that gets found. Upgrades go site by site, and the easy ones go first. The remote location, the older equipment, the system a contractor manages: those wait. Attackers don’t start with your best-protected site. They look for the one you haven’t gotten to yet. In energy, that’s often the one hours from the nearest person.
What to ask your team
Did we act on the last warning?
A good answer: “Yes. After France, we checked every site with connected equipment. Here’s what we found and what we changed.”
Red flag: “We looked into it,” with no list of what was checked or changed.
How do we know the fix worked?
A good answer: “We tested it afterward. Default passwords are gone, and nothing we fixed can still be reached from the internet.”
Red flag: “The vendor said it was handled.”
What equipment sits outside our own security?
A good answer: “Here’s every system a vendor installed or manages at our sites, how it connects, and who’s responsible for securing it.”
Red flag: “That’s the vendor’s network, not ours.”
Which sites are last on the list?
A good answer: “These locations haven’t been upgraded yet. Here’s the date for each, and here’s what’s protecting them until then.”
Red flag: “We’re getting to them.”
Who owns follow-through, and by when?
A good answer: “This person owns it. Here’s the deadline and when we’ll report back.”
Red flag: “IT and operations are working on it together,” with no single owner or date.
Where to start
Two steps close the gap between knowing and fixing. First, look at your company from the outside, the way an attacker would, including equipment your vendors manage on your behalf. You want to see what’s actually exposed, not what you assume is. Second, test what you find, and test again after changes are made. A fix nobody has verified is still an assumption.
The bottom line
A warning only protects you if someone acts on it and confirms it worked.
Three weeks after France, the businesses that followed through were spared. The ones that were hit weren’t caught by anything new. They were caught by the same weakness, sitting on the last site, the vendor-managed system or the to-do that never got checked off. There will be another warning. What matters is whether your team can show you it was handled.
Sources
The Hacker News, “New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food,” November 3, 2026 | The Associated Press, via ComplexDiscovery, on the French government’s figure of about 700 affected supermarkets