The attack vector is not yet confirmed. A source in Lecornu's office told Reuters that ANSSI has found signs the attack began with a vulnerability at Danish engineering firm Danfoss, whose refrigeration controls are used in the affected units. Danfoss said the units "were running outdated firmware" and that it had long urged customers to update. Claroty's Team82 previously documented vulnerabilities in the Danfoss AK-SM 800A controller, which Danfoss said software updates addressed. ANSSI's final findings, the full scope of losses, and the extent of the affected countries' impact have not been made public.
For attorneys, the case raises questions of supplier accountability for industrial controllers and the legal exposure of retailers that rely on remotely accessible cold-chain systems. Watch for the Paris prosecutor's charging decisions, any ANSSI public report, and whether the French retail association follows through on its demand for "full transparency" from the software supplier. Clients operating connected refrigeration or other building-control systems should review remote maintenance access and firmware update practices now.