Industrial Cybersecurity: lessons from the cyberattack on French supermarkets

November 3, 2026

During the night of 11 to 12 October, it was anything but business as usual for major supermarket chains in France. A coordinated attack targeted the refrigeration systems of hundreds of stores, with estimates suggesting that around 700 may have been affected. According to the French National Cybersecurity Agency (ANSSI), the cause was basic security failures: control systems directly accessible from the internet, protected by little more than poorly managed passwords.

Once inside, the attackers could effectively manipulate the systems as they wished. They chose to alter operating temperatures and other functions such as the defrost cycle. This function raises the operating temperature of the evaporator in a cold room or freezer so that ice can be removed from its fins, allowing it to continue operating as efficiently as possible. In this case, however, forcing the systems to operate in this way led to small fires breaking out, which could have resulted in an even more serious incident.

A cyberattack on refrigeration systems can lead to food losses and equipment damage.

Cybersecurity risks beyond supermarkets

It is certainly a striking story, but with no human casualties, as people used to say about piracy many years ago. After all, all that happened was that some supermarkets lost their refrigerated stock and some of their equipment. The attackers raised the temperatures and that was it, right?

No.

Because…

What if, instead, they disabled the alarms, assuming they existed, or changed their thresholds, switched off food refrigeration and turned it back on before staff arrived for their shifts? Who would have noticed? How many people might have consumed spoiled food before anyone realised what had happened?

What if it happened in a hospital, a pharmacy or a laboratory storing medicines that need to be administered to patients who depend on them? What would the cost be? Assuming human lives can be given a price.

What if it happened to a transport or retail company, or to energy or water infrastructure…?

The cyberattack on French supermarkets is just one example. ANSSI's director expressed his frustration: "These are basic security failures, starting with the direct exposure of refrigeration equipment to the internet and its administration without specific security measures, weak passwords, that sort of thing."

Implementing Cybersecurity requires analysis and design. It starts with the simplest measures and progresses to the most complex. The simplest step is to ask the right questions:

Do I know what control equipment I have at my sites and who manages it?
Is any of it accessible from the internet without going through a secure connection?
How do my maintenance providers connect? Do they share a username and password?
Is my control network segregated from the rest of the network?
Would I know if someone changed a temperature setting at three in the morning? Is any countermeasure in place?

■ If the answer to any of these questions is I don't know, it is time to start treating Cybersecurity as an investment rather than a cost. The cost is what the affected French supermarkets have had to bear in discarded food and damaged industrial equipment.

A cyberattack can affect facilities, products and people.

Industrial Cybersecurity measures

1. The first step is always an assessment.

An accurate assessment of the company's industrial Cybersecurity posture helps it scope the effort required and define an appropriate Cybersecurity implementation programme. The assessment can also identify training and awareness needs.

—This is what ANSSI's director pointed out: awareness efforts are pointless if the lessons learned about protecting industrial systems are not put into practice, and the failure of those efforts only became apparent when the incident occurred.

2. Strengthen the perimeter

This includes controlling who gets in and how. Remote access should be routed through a secure network, using individually identified accounts with strong authentication, session-specific permissions and a password rotation policy. Access logging is also essential.

3. Establish internal firewalls

In other words, segregate and segment internal networks. This limits the activity of a potential intruder and reduces the risk of an incident in one part of the network or a specific zone spreading to the rest of the organisation.

4. Monitor the internal network

Continuous monitoring of internal activity helps detect malicious behaviour or activity and supports an earlier, more proactive response. Because a reinforced front door alone is not enough. Cameras and security services matter inside a business too.

Assessment, secure access, segmentation and monitoring all help reduce risk.

From assessment to monitoring in industrial environments

Protecting industrial environments involves a range of capabilities:

Industrial Cybersecurity Assessments (ECI) at different levels, from a basic exposure assessment through to an architecture review and a security assurance plan.
Training and awareness tailored to technical and business teams to strengthen practices for protecting industrial systems.
Secure remote access and access management to restrict connections to authorised users and log their access to systems.
OT network segmentation to limit the activity of a potential intruder and reduce the risk of an incident spreading to other areas of the network.
24/7 managed OT monitoring of industrial networks to detect malicious activity and enable an early response.

The incident in France shows that basic does not mean superficial or unimportant. The potential damage can be significant, and having a sound Cybersecurity investment strategy is essential.

■ At Telefónica, we help companies identify the needs of each environment and assess the next steps. Based on that analysis, we support them in prioritising protection measures according to their risks and operational requirements.