Somewhere in Europe this week, a night-shift worker watched a freezer case go into defrost mode and had no way to stop it. In France, according to Paris prosecutors, the same kind of attack on refrigeration controls hit hundreds of stores and was linked to food waste and several fires from overheating equipment. Fires, not just spoiled yogurt. Nobody should treat this as a quirky IT story.
The cold chain is the quiet backbone of modern life. It keeps insulin-adjacent groceries, infant formula, meat, dairy and frozen meals safe for people who cannot buy a week's food at a time. We have spent years wiring it to the internet because remote monitoring is cheaper than paying people and because outside operators can manage thousands of units from one dashboard. That is efficient, right up to the moment someone else logs in.
The details matter, and so does restraint. In Belgium, a refrigeration operator's chief executive says a cyberattack flipped evaporator units into defrost. In Sweden, ICA and Coop say they have not confirmed an attack across their networks. We should not pretend to know more than that. But the pattern, three countries in a few weeks with the same failure in the same kind of equipment, is a warning that arrived before the bill did.
The Right's instinct will be to talk about foreign adversaries, and perhaps that is part of the story. But identifying the burglar does not excuse leaving the door unlocked. Grocery chains are large, sophisticated companies. They pour money into loyalty apps, price optimization and customer data. Whether they spent comparable effort making sure a compromised vendor system cannot cook their inventory is a fair question, and the answer so far looks like no.
This is what happens when critical infrastructure is treated as a private cost center. Resilience is invisible when it works and expensive when it is built. Each contract goes to the cheapest remote-managed system, risk gets pushed down the chain to a subcontractor, and the subcontractor's customers discover the weakness in public. The EU's NIS2 rules explicitly count food distribution among the sectors that need serious cybersecurity obligations. Too many governments have been slow to turn rules like that into real enforcement, and a rule nobody audits is a press release.
Who pays when it fails? Not the shareholders first. Chains will claim insurance and write off the loss. Store employees clean up the mess and absorb the customer anger. Shoppers lose access to basics, and eventually pay for the shrinkage in prices, in a period when families have already been squeezed by grocery inflation. Small franchisees and independent stores, without a corporate security team, are the most exposed. And when equipment overheats and burns, the people standing next to it are workers.
The Left should be specific about what it wants. First, binding security standards for refrigeration and building-control systems, with independent audits and real penalties for executives, not just fines the company can budget for. Second, a requirement that critical equipment can be switched to local manual control, so a cyber incident does not become a physical hazard. Third, liability that follows the contract chain, so a chain cannot shrug and blame its vendor. Fourth, public reporting of incidents, so regulators and other retailers learn from each failure instead of keeping it as a private embarrassment.
None of this is anti-business. It is the ordinary bargain we strike with every industry whose failure can hurt the public: you may profit from it, but you must make it safe. We demand fire codes for buildings and inspection regimes for kitchens. A supermarket's digital nervous system deserves the same seriousness.
The lesson of the French fires was available to everyone. If Belgium and Sweden are the sequel, the excuse of surprise has run out.
How it may affect me
If your local store was affected, expect gaps in chilled and frozen sections. Discard perishable food that was kept above about 4°C (40°F) for more than two hours, and avoid refreezing anything that has thawed. Check recall notices before assuming stock is safe.
