On the night of Sunday, October 11, refrigerators and freezers at hundreds of supermarkets across France began to heat up. What might have initially appeared to be a refrigeration system failure was, in fact, a cyberattack. The attackers did not need to enter the stores. They simply sent a remote command that triggered defrost cycles, raising temperatures to around 50°C (122°F). Large quantities of fresh and frozen food had to be discarded, and in some stores, the equipment itself was even damaged by overheating.
The supermarket chains were not the direct target of the attacks. Instead, the attackers targeted refrigeration control systems made by different manufacturers. In 2023 and 2025, cybersecurity firms had warned of vulnerabilities that could allow unauthorized access to these systems without a password and enable temperatures to be manipulated remotely. Although the manufacturer provided fixes for compatible models, many of the affected systems were older and no longer receiving updates.
This case offers several important lessons. The first is that no company is immune to a cyberattack, and that digital transformation is changing the nature of cyber risk. As organizations digitize their operations and adopt technologies such as artificial intelligence, they become increasingly dependent on technology systems, platforms, and services, which in turn increases their exposure to potential attacks.
This is compounded by reliance on third parties, whose systems are not always under the company’s direct control. A vulnerability at any point in this chain can lead to operational disruptions, financial losses, and significant reputational damage.
Another lesson is that many risks can be prevented if action is taken early. Outdated equipment, known security vulnerabilities that remain unaddressed, or necessary investments that are postponed can leave a company exposed to an attack. Ignoring these warning signs increases risk and can magnify the consequences of an incident.
But there is a broader lesson. Cybersecurity risks must be treated as a strategic issue, not solely as a technical one. An attack can disrupt operations or services, cause financial losses, or compromise business continuity. Cybersecurity decisions must therefore be part of the company’s broader strategic decision-making. This means aligning cybersecurity with business objectives and risk appetite, while assessing its potential financial, operational, and reputational impacts.
To achieve this, the board must provide effective oversight. This requires clearly defining the roles of board members and committees and ensuring they have the knowledge needed to understand these risks and ask the right questions. Training, regular crisis scenario exercises, and support from external experts can help strengthen the board’s oversight capabilities.
The board must also define the level of risk the company is willing to accept and have timely information to oversee how that risk is being managed. Reporting should be clear, use straightforward language, and translate technical issues into business terms, with alerts that make it possible to identify changes in risk exposure and activate appropriate escalation mechanisms.
This allows the board to monitor risk scenarios, assess mitigation measures, and evaluate the organization’s ability to prepare for and respond to an incident while maintaining business continuity.
It is equally important to recognize that a company’s security also depends on those around it. The case of the French supermarkets shows how a weakness in a single supplier can compromise an entire operation. Companies must therefore have a clear understanding of their third parties in order to identify critical dependencies, assess the associated risks, and require preventive controls that are proportionate to the level of exposure they represent.
In such an interconnected environment, collaboration is part of the defense. No organization can protect itself in isolation, and sharing information about threats and best practices strengthens the entire chain. Cyber risk, therefore, is not governed when an attack occurs, but through the decisions made long before it happens.
By Susana Sierra
Published in El Mostrador
