Nobody has claimed responsibility, and officials have not said who is behind the attack. The Paris prosecutor's office opened an investigation on Monday, October 13, and is treating it as a large-scale cyberattack. Its stated goals are to identify the victims and link them to the reported food losses and fires. France's cybersecurity agency ANSSI is investigating nationally and with European counterparts. Prime Minister Sébastien Lecornu ordered the probe, according to a person in his office. Investigators found that the affected fridges ran software from Danish supplier Danfoss. ANSSI has contacted the vendor and is searching for other French firms using the same systems. Forbes reports that Danfoss told customers many affected units have reached end of life and no longer receive security updates.
The attack exploited a known weakness. Supermarket cold aisles are typically managed through internet-accessible control panels that let maintenance firms adjust settings remotely. Claroty researchers flagged multiple vulnerabilities in Danfoss technology in August, and the company had patched them in a software update. Pen Test Partners' Ken Munro told Reuters the hack reflected a failure of basic cyber hygiene. ANSSI has advised operators of affected freezer models to disconnect them from the internet or restrict access, and to install updates. BFM reported that the attackers appear to have triggered a forced defrost mode.
Operators of networked refrigeration should check whether their units run affected Danfoss software and whether they are reachable from the internet. Units past end of life will not receive patches, so replacement or isolation is the only fix. Attribution and method remain unresolved, and the Paris investigation is ongoing. Any firm with connected industrial controls should expect regulatory questions about remote access and patch management.