In this blog
On the night of 11 October, in hundreds of supermarkets across Europe, freezers turned into weapons.
Attackers gained access to the refrigeration controllers in hundreds of stores, drove temperatures toward 50°C, and stretched defrost cycles from one hour to eight so alarms would stay quiet while the damage spread. By morning, staff arrived to spoiled stock and smoking equipment. Fire broke out in several stores. According to CNBC, one retail chief executive put the national losses at tens of millions of Euros in a single day.
This was not a traditional data breach: nobody encrypted a file server, and no ransom note appeared on a point-of-sale screen. The attack went straight for the physical operation of the business.
The same exposure exists across every retail estate: connected equipment installed by contractors, funded by facilities budgets, running outdated firmware, and sitting outside the security team’s view.
Disaster recovery plans assume a trustworthy environment, and a clever adversary will reveal some harsh truths. But retailers that define their Minimum Viable Business (MVB), protect an immutable copy of it, and rehearse its recovery will keep the doors open when the next connected device turns against them.
A Physical Attack Delivered Through a Network
This remarkable hack drew a lot of attention. France's national cybersecurity agency, ANSSI, issued an alert identifying the affected refrigeration management systems and advising operators to disconnect them from the internet or restrict access, and to apply available software updates. The equipment manufacturer confirmed that the affected units were running outdated firmware. The Paris prosecutor's office opened an investigation, and the prime minister directed ANSSI to lead the technical response.
But if you strip away the headlines, the incident is familiar to anyone who runs security for a retail estate. A fleet of operational equipment sat on connected networks, running out-of-date software. Someone found it, understood how it worked, and used it against the business at scale, overnight, when the fewest people were watching.
There’s a recognizable threat pattern. Every retailer group in Europe has equipment that shares the same vulnerabilites—and they need to take corrective action immediately.
The Equipment You Forgot Is the Equipment They Found
A modern retailer brand is not just a storefront or a front desk. It is a network of businesses running as one. That means payments, loyalty, e-commerce, warehousing and distribution, facilities, booking engines, and guest services, all stitched together by digital infrastructure that most customers never see. These systems enjoy the oversight of enterprise security teams.
Refrigeration controllers, building management systems, digital signage, and door access sit in the same web. But these connected devices are rarely owned by the security team.
That ownership gap is a significant point of failure. Equipment installed years ago, commissioned by a contractor, maintained by a facilities budget, and connected to the network because connectivity was convenient is now part of the attack surface. ANSSI's advice to disconnect the affected systems was the right emergency response, but it is also an admission of how little control defenders had over the devices in the first place. Prevention and detection still matter, but a defense that depends on every connected device in every store being patched is a defense that has already failed.
Disaster Recovery Was Not Built for an Adversary
Most retailers have a disaster recovery plan. But most of those plans would have been useless on the morning of 12 October.
Disaster recovery assumes you can trust your environment. When a storage array fails, you know what broke and know where your clean backups are. The failure does not fight back.
Cyber recovery is different. In the case of an attack, you do not know what the attacker touched. You cannot be sure your backups were not staged for destruction weeks earlier. The adversary may still be inside the network while you rebuild. If identity is down, nothing else recovers at all. While you work to recover, customers, journalists, and regulators are all watching in real time.
For a retailer, the business is leaking revenue as the security team navigates the cyber recovery. When connected equipment is compromised, the first instinct is to isolate it, which is what ANSSI advised. But isolating the cold chain, the building controls, or the store network means running the business without them.
Every security leader in retail should be asking one question today: “What do we need to keep selling if we have to pull the plug on part of a store, or part of the estate, tonight?”
Minimum Viable Business for Retail
Rubrik calls the answer to that question a Minimum Viable Business: a core set of operations that focuses on critical functions and services that can operate in adverse conditions for a short period of time. A MVB ensures operational continuity when normal operations are not possible.
For retail, a MVB could include Identity and network infrastructure come first, because nothing recovers without them. Beyond that, the specific systems and applications will vary from one business to the next, but they typically include payment processing and point of sale, inventory management, e-commerce, booking and reservation engines, loyalty and CRM, ERP and financial systems, and the communication tools that let a dispersed workforce coordinate when the usual channels are down.
In the case of a grocer, the list also includes the systems that manage in-store equipment, such as the refrigeration that keeps the cold chain intact.
Defining the list of critical MVB functions is not a technology exercise, and it cannot be the CISO's decision alone at two in the morning. It takes executives, operations, and IT meeting before a crisis occurs, agreeing on the handful of services the business literally cannot function without, mapping their dependencies, and rehearsing what happens when a service fails.
The retailers that recover from the next incident fastest will be the ones that have defined a Minimum Viable Business, hold a trusted, immutable copy of it, and have practiced deploying it under (simulated) duress.
Teams leave operational technology out of recovery planning because it feels too legacy, too specialized, or too far from IT. This incident shows why that is a mistake. For a grocer, refrigeration is the business: once controllers are forced into continuous defrost, the cold chain can break within hours and stock has to be destroyed.
The systems that supervise and configure in-store equipment therefore belong in the MVB: supervisory servers, engineering workstations, known-good controller configurations, and the temperature and HACCP records that prove food safety after the fact. For each, retailers should build a recoverable blueprint that defines what restores first, what it depends on, which restore point is clean, and which isolated network receives it. Then they should rehearse it. The recovery-time objective for this tier is measured in hours, not days.
How Rubrik Turns a Weeks-Long Incident into an Overnight One
In this new AI frontier, attacks like the one that hit France’s supermarkets will become more prevalent. AI now performs reconnaissance, exploitation, and coordination faster than any defender can respond. Additionally, retailers are introducing new risk as they deploy their own AI agents with privileged access inside the perimeter. Defenders must assume breach and assume agentic overreach at the same time. That is why you need AI resilience.
Rubrik does not patch refrigeration controllers. Rubrik does make sure that when connected equipment is turned against the business, the business around it survives and recovers quickly. Rubrik Agentic Cyber ResilienceTM unifies data, identity, and AI so retailers can withstand AI-powered attacks and rogue agents, recover business operations at machine speed, and safely scale AI without losing control.
Rubrik holds air-gapped, immutable copies of the systems that make up your Minimum Viable Business, so an attacker who has moved from a store controller into the corporate network cannot encrypt or delete the one thing the business needs to recover. The platform continuously indexes, classifies, and scans that data for threats as it is ingested, so unusual change across the store estate surfaces as a signal rather than a surprise at opening time, and clean recovery points are already identified when the alert fires. Here’s how:
When an incident is declared, Rubrik Threat Analytics scans and pinpoints historical backups for indicators of compromise to establish how long an attacker has been present, and identifies the last clean recovery point before any restore begins.
- Rubrik Threat Containment isolates infected snapshots so the recovery does not reintroduce the malware it is meant to remove.
- Rubrik Identity Resilience correlates change signals across Active Directory, Entra ID, and Okta, rolls back what is malicious, and removes attacker persistence while preserving everything legitimate, because no point-of-sale terminal, payment gateway, or booking engine can authenticate while identity is down.
- Rubrik Orchestrated Cyber Recovery then brings the rest of the Minimum Viable Business back in a pre-sequenced order, by priority rather than panic, into an isolated environment the attacker cannot reach.
- Rubrik Cyber Recovery Simulation lets the team validate that plan before the night it matters.
- Rubrik Agent Cloud monitors every agent, enforces guardrails before an action executes, and rewinds destructive changes before a rogue agent becomes the next incident.
None of this would have stopped a thermostat from being told to warm up. All of it determines whether a retailer spends the following week running stores or rebuilding them. Attackers are already using AI to find and exploit the equipment you forgot about. Rubrik puts the same speed on the defender’s side, across data, identity, and AI, so the business comes back faster than the adversary can take it down.
The Next Overnight Attack Is Already in Motion
The French supermarkets will replace their stock, repair their stores, and reconnect their equipment under far tighter controls. The investigation will eventually explain how the attackers got in. But across EMEA, retailer groups should not wait for that investigation to conclude. The lesson from this hack is already clear: every business runs equipment it does not fully control, on networks it did not fully design, against adversaries who are gaining speed and effectiveness.
Regulation is moving in the same direction. NIS2 brings food distribution into scope and makes supply-chain security, business continuity and recovery a board-level responsibility. The Cyber Resilience Act is starting to hold manufacturers of connected equipment accountable for the vulnerabilities in their products. Neither will patch a fridge overnight. Both make the same point: resilience is now something retailers will be expected to demonstrate, not just claim.
The attackers chose the fridges this time. Next time they will choose something else, and the people standing in the aisle at six in the morning will not care which. They will only care whether the store opens.
Rubrik works with retail security teams across EMEA to define their Minimum Viable Business, map the dependencies behind it, and prove it can be recovered before the night it matters. Request a meeting with our Minimum Viable Business experts today.
Sources:
CNBC, “French supermarket fridges get hacked, heating to 122°F and sparking fires,” 13 October 2026. https://www.cnbc.com/amp/2026/10/13/france-supermarket-hack-cyberattack-fridges-fires.html