France's Supermarket Freezer Hack Shows Why Japan Is Next

The night the freezers became ovens

France woke up to a nightmare neither cybersecurity nor food-safety experts saw coming. Overnight, between October 11 and 12, a single coordinated cyberattack forced the refrigeration and freezer systems of dozens of major supermarket chains across the country to run past their limits — and some stores reported internal temperatures climbing as high as 80°C. The result was catastrophic: at least 300 stores were affected, millions of products had to be discarded, and some operators estimated losses in the hundreds of millions of euros.

What makes this attack so alarming is not the scale alone but the mechanism. French media identified the target as the defrost function built into network-connected commercial refrigeration units. The purpose of defrost is simple and uncontroversial: periodically raise the temperature of a cold-storage unit to melt accumulated frost and maintain cooling efficiency. But when that function is accessible over a network — and when no one is watching — it can be held at maximum indefinitely. Left running long enough, the internal temperature of a large commercial freezer can climb from -20°C to 50°C or beyond within a single night. And the food inside — frozen meals, ice cream, raw meat, pharmaceutical supplies stored in supermarket chillers — becomes instantly unsalvageable.

A store spokesperson told reporters: “At 80 degrees tonight, unfortunately we had to dispose of every refrigerated and frozen product. We never imagined this could happen at our supermarket.”

The real weapon was abandoned software

But the most disturbing detail emerged only after the initial panic subsided. French investigations revealed that the software controlling these refrigeration networks was an outdated version that the vendor had stopped selling. The system was likely still receiving security updates — or perhaps it was not. Whatever the case, the software had never been designed with hostile remote access in mind. A defrost command was a legitimate operational input, not an intrusion vector. The attackers simply sent it anyway.

This is the silent crisis of critical infrastructure in the twenty-first century: the things that keep our food cold, our water clean, and our power grids stable are increasingly connected to the internet — and the software that runs them is frequently old, poorly maintained, and sold to buyers who assume “network connectivity” means “convenience” rather than “exposure.”

The French supermarket chain did not choose insecure software. They chose the only version of a vendor’s system that still met their needs at the time of purchase — and then the vendor moved on. That mismatch between operational dependence and commercial support is where supply-chain risk lives.

Why Japan should already be sweating

Japanese coverage has been urgent for a reason. The same architecture underlies Japan’s supermarket cold chain. Major retailers — Seven & i, AEON, Ito Yokado — rely on network-connected refrigeration systems supplied by companies such as Nissui, Daikin, and Mitsubishi Heavy Industries. A Nissui Group subsidiary experienced a separate but relevant incident on October 7, when a contracted operator suffered unauthorized access that disrupted the inbound and outbound logistics of certain frozen-food products. Full recovery had not yet been confirmed at press time.

The Japan Electrical Manufacturers’ Association (JEITA) has documented a sharp rise in IoT-related incidents since 2024. Cameras have been remotely hijacked for voyeurism. Electric door locks have opened without authorization. Home routers have been compromised and repurposed for fraud and ransom campaigns. The attacks are not theoretical — they are daily headlines, and they are accelerating.

Researchers at the National Institute of Information and Communications Technology recorded over 70.1 billion cyber-attacks related to communications in 2025 alone, with a clear trend toward household and commercial IoT devices as entry points. The assumption that a refrigerator is “just a fridge” is how attackers get inside.

What separates Japan from France right now

Japan has not yet experienced a cold-chain attack on the scale of France’s. That is largely because Japanese commercial refrigeration systems tend to be managed by in-house IT teams, regional facilities managers, and long-standing vendor relationships that predate the IoT era. Many units still operate on closed local networks rather than public internet connections — a slower, clumsier architecture that is also more defensible.

But that advantage is eroding fast. CEATEC 2026, Japan’s largest digital-technology exhibition, opened on October 13 with extensive interactive simulations demonstrating how a single poor security decision — an unchanged default password, a shared credential across services, an unpatched router — can multiply corporate losses by orders of magnitude. The exhibits were not abstract. They used real scenarios, real financial models, and real timelines.

“In the next one to two years, we’ve seen cases where IoT devices are attacked and customers are harmed — doorphones, washing machines, air conditioners, refrigerators all connecting to the network,” said Masaaki Yamamoto, a JEITA lead researcher. “The convenience is real. The threat is now in our living rooms.”

The three moves that matter

The advice from French and Japanese cybersecurity experts overlaps almost exactly, and both are frustratingly simple:

First, use unique, complex passwords for every network-connected system — and do not reuse credentials across services. A single compromised password can unlock an entire refrigeration network if that password appears anywhere else. Changing the last two or three characters of a reused password across dozens of accounts can reduce the blast radius dramatically.

Second, treat outdated software as a known risk, not an inconvenience. The French attack exploited a version of refrigeration-management software that the vendor no longer sold. If your system is unsupported, it is not “working fine.” It is waiting for someone to find the right command.

Third, segment your networks. Commercial refrigeration units should never share a network with payment terminals, employee Wi-Fi, or guest access points. A single compromised device should not become a gateway to every other device in the building.

What happens next

France’s supermarket attack will become a case study in supply-chain security courses within a year. Japanese retailers are already reviewing their refrigeration contracts. The real question is whether they will find the political and commercial courage to replace systems that work — but only because no one has yet sent the right command.

The attackers did not need sophisticated malware. They needed a defrost button and an internet connection. Everything else was configuration.

Cold chains are not just logistical infrastructure. They are public-health infrastructure. When supermarkets in Paris lost millions of dollars in food overnight, the visible cost was financial. The invisible cost was trust — the knowledge that the system keeping your frozen dinner at the right temperature is one stranger’s keystroke away from failure.

Japan’s supply chains are similarly fragile. The hardware is world-class. The software often is not. And the attackers are already testing the same assumptions France just learned the hard way.