Who the investigators suspect

The Paris public prosecutor's office opened an investigation immediately after the attack, and its detectives from the anti-cybercrime unit are now working a case in which nobody has stepped forward. That silence has pushed attention onto the scenarios specialists consider plausible.

Gérôme Billois of Wavestone said the two most feasible explanations were either young people or activists proving what they could do, or a destabilising attack by internal or external state actors. Asked which he judged more likely, he named the countries he sees as the usual suspects.

Billois also cautioned against expecting a quick answer. "It could take weeks if not months to be certain because hackers know how to hide their tracks," he said. Cybersecurity specialist Marta Rybczyńska said tracing depends on capability: a handful of youngsters would be easier to find, professionals take longer, and hackers operating from abroad would make the task extremely difficult. "If they're in a foreign country, it'll be extremely difficult," she said.

How the attackers stayed hidden

The hackers pirated controllers supplied by the Danish company Danfoss, which run the freezers and fridges; most supermarket cold aisles are internet-connected for remote maintenance and failure alerts. What investigators are still piecing together is how so much tampering went unnoticed overnight.

Initial investigations suggest two evasion methods, according to the report's findings. Either the attackers:

• •disabled alarm systems before tampering with the thermostats, or
• •extended the defrost programme by several hours so the alarms were never triggered.

Rybczyńska's own review of the equipment pointed to a deeper weakness. She found previous warnings that old freezers were running out-of-date software while newer models carried unfixed firmware, and noted that "some of these freezers hadn't been supported by the manufacturers for several years".

In many cases, she said, "many of the freezers appear to have been running with a default password," with alerts modified or switched off so that shops only realised something was wrong when staff arrived the next morning.

The cost and the blame

The bill for the affected retailers is still being counted. Intermarché CEO Thierry Cotillard said losses could run to "tens of millions of euros", and store companies say that sum is unlikely to be covered by their insurance.

Where the blame falls is itself disputed. Coopérative U president Dominique Schelcher, whose chain saw 80 of its 2,000 supermarkets targeted, has shifted responsibility onto unnamed refrigeration contractors that maintain cold aisle equipment.

Danfoss, for its part, said it identified the security flaws last year, has long recommended updates or replacement of obsolete systems, and noted that the affected units were "running outdated firmware".

Billois argued the responsibility is shared three ways - between supermarkets, the subcontracting refrigeration companies and the software company - but said that in the end it comes down to freezers connected to the internet without being adequately secured, a combination he called a wake-up call.

A pattern of French breaches

The freezer attack is not an isolated event but the latest entry in a run of French cyber incidents. Over the last three years, hackers have breached France's health system, France Travail, the government-run jobseekers agency, the National Agency for Identity Documents (ANTS) and most big mobile phone companies. This summer, the economy and finance ministry lost the personal and fiscal records of 678,000 taxpayers in a series of attacks.

• •According to Upguard, France is the most heavily pirated country in Europe by the volume of records exposed by hackers.
• •The French attack mirrors an August incident in the US, where connected fridges and freezers at a dozen military commissaries went into unscheduled defrost cycles overnight, causing massive food loss.
• •The French attack comes as the EU's Cyber Resilience Act (2024), which would introduce mandatory security for internet-connected devices, has still not been adopted. Billois called the delay a disaster: "It's a text that's not political and that everyone agrees on but is delayed... and this has been a disaster".

France's cyber-attack alert centre ANSSI has confirmed in the days since the first wave that supermarkets using controllers from two other companies were also targeted, widening the scope of the inquiry beyond Danfoss equipment.

For now, the central question remains open. No one has claimed responsibility for the supermarket cyber-attack; Paris prosecutors have instructed detectives from its anti-cybercrime unit, and experts warn that certainty about who is behind it could take weeks or months.