The cyberattack last week that hit hundreds of French supermarket refrigerators had Europeans wondering if the nonstop warnings about AI risks had finally landed in the real world.
They hadn’t — at least, not yet.
Experts say the attack, which forced hundreds of retailers to throw away defrosted food and spoiled milk, was mostly a reminder of the importance of old-school cybersecurity in safeguarding essential goods and services.
The attack is a “typical example” of how “low-key cyber-enabled sabotage can affect very crucial supply for society,” said Ferdinand Gehringer, hybrid threats lead at FTI Consulting.
It’s arguably the most consequential hack in the European Union this year, with tangible, disruptive real-world repercussions. France’s Prime Minister Sébastien Lecornu personally managed the fallout, which prompted coordination and information-sharing at the EU level.
The perpetrators, whose identity and motives are currently unknown, hacked into digital systems to remotely raise the temperature of refrigerators in supermarkets including Intermarché and Carrefour.
One cybersecurity expert working with Lecornu’s office said the French government held meetings after the attack to try to map all the potentially affected sectors, beyond supermarkets. “We’re in the middle of the flu vaccination campaign,” he said, referring to vaccine storage, which also relies on temperature control solutions, though no such attacks have been registered.
To add to the fear and confusion, supermarkets in the Netherlands and Belgium experienced unrelated cyber incidents that same week. Though there was limited impact in those cases, they were a good example of “how big our reliance is in the food supply chain on IT and network systems,” Dutch food security minister Silvio Erkens told POLITICO.
The attacks come after citizens and policymakers have spent months being bombarded with warnings about scenarios in which unpredictable advanced artificial intelligence models escape human control.
While most good and bad actors on the internet are increasingly using AI models to increase speed and capacity, cyber experts say the hackers in question in the French case most likely used traditional methods to take advantage of devices needlessly exposed to the internet.
Connecting devices to the internet in this way is “an old-fashioned bad practice,” said Amir Preminger, chief technology officer at Claroty, a cybersecurity company that identified a software flaw in a product made by Danfoss, one of the refrigeration companies targeted by the French hacks. Danfoss fixed that flaw in 2025.
Food systems
The attacks come at a time when Europe’s food security is already under considerable pressure due to geopolitical insecurity and climate change. The continuing disruptions in the Strait of Hormuz are pushing up fuel and fertilizer prices at a time where farmers struggle with the fallout of extreme drought that caused lower yields in many parts of Europe. These problems are compounded by the blockade of the Black Sea which is fueling the rise of global food prices.
“It is very serious that cyber criminals attack our food systems,” said Else Groen, director general of trade body Independent Retail Europe. She nonetheless stressed that food supply chains are resilient, which reduces the chances that consumer food supply would be endangered — even if such attacks are already a “major blow” for retailers operating on razor-thin margins.
The incidents bring to the fore a long-running problem with so-called operational technology, meaning industrial devices with physical outputs, like refrigeration systems. Critical sectors are packed with these kinds of devices, many of which are old, poorly protected, unnecessarily connected to the Internet, or some combination of the three. They’re also obscure and sometimes forgotten, despite the ramifications if they’re tampered with.
And last week’s problems are far from solved. French and German cyber authorities warned that attacks were probably still ongoing, and the Greek cyber agency and an industry tracker said after the attack that there were hundreds of devices still connected to the internet.
Preminger too said there are still devices exposed, though he added that the number is declining, and not all are necessarily vulnerable to attack. Another research group found that the number of exposed Danfoss devices had significantly decreased.
Finding a fix
What’s changed with the widespread diffusion of advanced AI models is that cyber attacks are now faster and easier to replicate. Claroty reproduced the original flaws in Danfoss products in 28 minutes at a cost of $6, it said.
In broad terms, AI makes it easier to carry out many types of cyberattacks and enables attackers to pounce on software flaws more quickly. Financially motivated cybercriminals — who have already spent years extorting businesses and disrupting essential services like hospitals — can use AI to simultaneously launch attacks on multiple targets.
Though the motive for the attacks on French supermarkets remains unknown, it is notable that there was no reported attempt at extortion. The strike did come as Russia ramps up its campaign of hybrid warfare against Europe, and senior EU and European leaders have consistently warned that Moscow could use cyberattacks to disrupt real-world services. Beyond food supplies, AI-enhanced targeting could be aimed at banking, hospitals and the functioning of the internet itself.
Still, these fears of bad human actors using AI should be distinguished from the science-fiction scenarios pushed by so-called AI doomers, in which bots themselves are motivated and able on their own to wipe out humanity.
Digital security experts, including the EU’s own in-house cyber team, are also turning to AI for defense. But it’s not a silver bullet, said Rémi Enjolras, a chief technology officer at Splunk, part of Cisco. Critical industries need to stop “seeing AI as a magical tool that will solve everything and go back to the fundamentals,” he said.
The EU has passed laws intended to force critical industries and product manufacturers to get those fundamentals right. But France, for example, is lagging in implementing such national regulations, and there are few other incentives to get companies to do that difficult and costly work.
Still, the images of empty supermarket shelves could provide a new incentive. “It should serve as a kind of a wake-up call,” Enjolras said.
Émile Marzolf contributed to this report.
Login
