At some point overnight on Sunday, October 11, someone reached into the refrigeration controllers at hundreds of French supermarkets and set them to defrost at 50 degrees Celsius. By Monday morning, Coopérative U’s president had confirmed the outage, Intermarché was telling reporters it would throw away all its fresh and frozen products, electronic shelf labels and deliveries were misfiring, and Prime Minister Sébastien Lecornu had ordered ANSSI — France’s national cybersecurity agency — to investigate. Paris prosecutors confirmed the attacks and noted that fires had been reported at some sites. The controllers appear to have come from Danfoss, the Danish controls supplier, which says it is aware of incidents affecting “a limited number of refrigeration management systems.”

Everyone is calling this unprecedented. It is — just not for the reason they mean.

The 50-Degree Command Was the Least Interesting Part

Nothing about the technique was new. A refrigerator has been able to defrost itself since before the microprocessor existed. Setting a controller to hold 50 degrees isn’t a zero-day. It’s a setting.

What’s unprecedented is the exchange rate. A stunt of this size — hundreds of stores, per Deutsche Welle, with investigators checking whether the same thing was happening in the Netherlands and the United States — bought its author a head of government, a national security agency, and a prosecutor’s office. For fifteen years, the cyber-threat industry has sold catastrophe: blackouts, pipelines, hospital ransomware, scenario decks with arrows pointing at the power grid. All of it assumes the adversary wants effects. This adversary wanted a Monday morning.

That is the strategic fact nobody wants to price in. Offense has gotten so cheap that annoyance is now worth doing at state scale. The old deterrence math — retaliation thresholds calibrated to deaths, blackouts, and physical destruction — has nothing to say about a target chosen precisely because it clears every threshold.

The Attack Didn’t Spoil the Food. It Spoiled the Receipt.

Here is the part the coverage keeps skating past. A supermarket does not throw away a pallet of frozen chicken because the chicken is warm. It throws it away because it can no longer prove the chicken was cold.

Every cold chain in Europe is, legally speaking, a chain of custody. Food safety regimes require documented temperature control, and the documentation is only as good as the instrument writing it. If the attacker owns the controller, the attacker owns the log. The moment the log is worthless, every unit in the affected stores becomes unsalable — not when it thaws, but when the intrusion is discovered. Deutsche Welle counted hundreds of stores and tons of spoiled frozen food. Intermarché didn’t dump its inventory because a freezer failed. It dumped its inventory because it could not certify that the freezer hadn’t.

So the vulnerability that actually cost money wasn’t the compressor. It was the attestation. A thermostat is a cheap, dumb, trusting device. We bolted it to a network, gave it a firmware update channel, and never asked what happens to a legal record when its author can be impersonated.

Nobody Sells the Fix, So Nobody Buys It

The fix is unglamorous, cheap, and available: sensing that signs its own readings at the point of measurement, with the signature verified somewhere the controller cannot reach. The silicon is a rounding error in a freezer’s bill of materials. The engineering is not the hard part.

Procurement is the hard part. Nobody in a grocery chain’s buying office wants to purchase the device whose primary output is evidence that a supplier should be paying for the loss. And the supplier has arranged its paperwork accordingly. Read Danfoss’s statement again — “a limited number of refrigeration management systems” — and notice it is a legal sentence, not a technical one. Under the standard terms for industrial controls, the vendor’s exposure tends to cap out near the price of the part. The inventory loss lands on the grocer. The grocer’s loss lands on the shopper.

“We don’t get paid to prove anything,” a refrigeration contractor said, restocking his van outside a supermarket in the Loire Valley the morning after. “We get paid to make the light go off on the panel.”

ANSSI will now do what such agencies do, which is hunt the intrusion. Good luck to them; the intruder may have spent less on this operation than a supermarket spends on a week of shrink. But the money was not lost at the intrusion layer. It was lost at the attestation layer, and no agency can audit a record that nobody is obligated to keep honestly.

The uncomfortable conclusion cuts both ways. It is not an argument for more regulators, and it is not an argument for fewer contracts. It is an argument for making the contract match the risk — for demanding that the people who sell you the controls warrant the thing they sold. Every supermarket group in France has the leverage to insist on that in its next purchase order. Almost none of them will, because the alternative costs about two cents a unit and looks, on a spreadsheet, exactly like nothing at all.

Sources