Retail connected the shop floor. Now it has to take responsibility for keeping it secure.
The connected supermarket has acquired an unexpected feature: remote spoilage.
After attacks hit hundreds of French shops in October, another wave of refrigeration incidents spread across Europe in early November. Carrefour, Delhaize, ICA and Sweden’s Coop were among the retailers affected. Staff found themselves dealing with compromised cooling systems and food that had to be discarded. reuters.com
There is something brutally clarifying about a cyberattack that ends with someone throwing dinner into a skip. No abstract debate about stolen credentials. No reassuring explanation that operations remain largely unaffected. The inventory is getting warmer.
For years, the retail technology pitch has been about removing friction. Fewer manual checks. Fewer maintenance visits. More control from a central dashboard.
The dashboard now comes with a question: who else has control?
The uncomfortable detail is how much of this risk was already visible. France’s cybersecurity authority identified compromises involving Danfoss, Copeland and Dixell controller families. Its guidance calls for removing exposed management interfaces from the public internet, securing remote access, updating supported equipment and dealing with systems that no longer receive security fixes. CERT-FR
That is a more complicated story than one missed patch. It is also a more revealing one. Retailers have equipment with different ages, suppliers, maintenance contracts and security capabilities, all performing the same essential job.
The fridge may still work perfectly. The software protecting it may have retired years ago.
Consider how easily responsibility can disappear. The retailer buys the equipment. A contractor maintains it. A manufacturer supplies the controller. Someone configures remote access. A security update arrives.
Who installs it? Who checks? Who pays for the interruption? Who decides that a functioning piece of machinery must be replaced because its software is no longer supported?
These are hypothetical questions about governance, not findings about any particular retailer. But every connected estate needs actual names against them. “Our supplier handles that” is an arrangement. It is not evidence that the work has been done.
The incentives deserve scrutiny. A new system’s labour savings arrive as an attractive number in an investment proposal. Its future security obligations arrive as recurring work for people who are already busy.
You can put the savings in a presentation. Keeping track of firmware versions makes a less exciting slide.
Yet the economics are straightforward. Imagine a grocer earning a 3% operating margin. A £100,000 incident cost would require roughly £3.3 million of additional sales to offset, assuming that same margin. That is an illustration, not an estimate of these attacks. It shows why apparently mundane infrastructure deserves serious attention.
A fridge protects an asset. Its security belongs in the calculation of what that asset costs to sell.
The consequences also extend beyond retail. Refrigeration controls at three French blood-service sites were affected during the November incidents. Monitoring and alarms detected the anomalies, and staff secured or moved the products. No blood products were reported lost and no health consequences were identified. The Record from Recorded Future News
That outcome matters. It demonstrates the value of detection, trained staff and a workable response. The reassuring part of this story is that people caught the problem and acted.
It also changes the conversation. A compromised cooling system can threaten food, medical supplies and other goods whose usefulness depends on remaining within a temperature range. The physical product does not care whether the failure began with a compressor or a compromised login.
Retail leaders should apply that lesson to the rest of the shop floor. Electronic shelf labels, cameras, access controls and building systems all deserve scrutiny of their connections, permissions and maintenance arrangements. Their risks differ. A digital price label is not automatically a route into the payments system. Architecture matters.
But every purchasing decision should include a lifetime question: who will keep this secure after the launch team has moved on?
Then there is AI-assisted development.
There is no established evidence in the reporting reviewed here that AI-generated code caused these refrigeration incidents. Joining those dots would produce a stronger headline and a weaker argument.
The separate concern is that faster software production can outrun the capacity to review it. Research presented at USENIX Security documented coding models recommending packages that did not exist. Such recommendations create an opportunity for attackers to publish malicious packages under the invented names. usenix.org
Existing dependencies need scrutiny too. Code being available on GitHub does not establish that it is secure, maintained or suitable for production. Equally, being open source does not make it unsafe. The question is what the business has verified before relying on it.
If AI helps a team produce more software, the business must also account for the additional software it will own: its dependencies, permissions, updates and eventual retirement.
The productivity gain is real only after those obligations are included.
For retailers, the response should be practical. Give connected equipment a named owner. Know which systems remain supported. Protect remote maintenance access. Test whether alarms and local procedures still work when the central system fails. Make suppliers demonstrate how security updates reach installed equipment.
And put those costs into the original business case.
The connected store can still be a better store. Remote monitoring can support good operations; automation can remove tedious work. But connection creates an ongoing obligation that survives the procurement announcement.
A customer standing in front of an empty chiller will never ask how innovative the refrigeration platform was.
They will go somewhere else.
