Somewhere in France, a refrigeration controller that nobody had patched in years was quietly keeping the cold chain alive. Then someone attacked it, and food spoiled, equipment overheated and smoked, and some of the country's biggest grocers pulled products from shelves. The hacker is the obvious villain. He is also the least interesting one.
The detail that matters is Danfoss's own admission: the affected controllers, the AK-SM800 and AK-SC355, were running outdated firmware that no longer received security updates. That is not an accident of nature. Someone designed a product meant to run a supermarket's refrigeration for many years, then stopped defending it long before the stores stopped relying on it. Someone else bought it, installed it, and kept it connected, through a third-party management provider, to a network the public now depends on for safe food.
"Legacy" is a word that makes a decision sound like weather. It was a choice by manufacturers who sell hardware but treat years of security support as a cost to be cut. It was a choice by retailers who outsource the monitoring of critical equipment and then discover, at 180 stores for Intermarché alone, that outsourcing the work did not outsource the consequences. Les Mousquetaires says the losses could reach several million euros. For groups of this size, that is a bill that can be absorbed, and that is exactly the problem. When failure is survivable for the company, prevention gets treated as optional.
The people who are not insured against it are everyone else. Shoppers have to trust that the chicken and the frozen vegetables are safe, and that trust is only as strong as the weakest unpatched box in a store's back room. Staff are the ones standing in a shop filling with smoke from overheating equipment, then clearing out spoiled stock. Suppliers and farmers, who sit upstream of all this, watch product get destroyed. Nobody asked any of them to accept a risk built on cost-cutting they never saw.
The strongest defense of the companies is that they are victims of crime, and that more regulation just adds paperwork while criminals keep innovating. Half of that is true. The attackers bear responsibility, and the Paris prosecutor is right to investigate. But "victim" is a flimsy shield when the vulnerability was known, the vendor had stopped issuing fixes, and the sector's whole economic logic rewards leaving old systems in place until they break. We do not accept that reasoning from building owners who skip fire inspections. Food refrigeration is public-health infrastructure, whatever the logo on the storefront.
The Left should say this plainly, because the Right's instinct will be to talk about hostile actors and national security while leaving the business model untouched. The answer to this kind of attack is not only better hunting of hackers. It is binding obligations: minimum support periods for connected industrial equipment, mandatory replacement or isolation of end-of-life devices, real liability for vendors and operators who ignore the risk, and audits with consequences. The EU has been building a framework, including its network-security directive and its Cyber Resilience Act, but frameworks phased in over years are cold comfort when the attack is happening now.
The Left also has to get its own house in order. We talk constantly about public goods and collective risk, yet cybersecurity gets treated as an IT line item rather than a question of who bears danger and who profits from neglect. This attack shows what that neglect looks like in practice: warm freezers, smoking machines, binned food.
The next target may be a hospital's cold storage, a vaccine warehouse, or a water plant. Governments can keep treating each incident as a freak event, or they can force the companies that profit from critical systems to pay for keeping them safe.
How it may affect me
If you shop at an affected chain, follow store notices and any recall or withdrawal announcements, and don't buy fresh or frozen items that look partly thawed or feel warm. At home, discard food that has thawed and been left at room temperature, and avoid refreezing thawed meat or fish. Keep receipts in case retailers announce refunds.
