Who Can Restart Your Cold Room Safely?
A working control screen is not enough to release a cold room back into service. Recovery needs a decision about the equipment, the stock and the people authorised to restart operations.
AFP reported on 12 October 2026: refrigeration attacks affected at least 300 Intermarché or Netto shops, more than 100 Coopérative U outlets and several E. Leclerc stores. Paris prosecutors were investigating food losses, damage and fires.
A forecast is not a recovery confirmation
An official Intermarché notice for Gradignan said the shop discarded all frozen goods and suspended frozen collection and home delivery after the night of 11 to 12 October. It expected a return on 14 October. At this article’s 15 October review, that notice still displayed the forecast, not a dated confirmation that frozen-stock services had resumed. Its scope is one store, not national recovery.
That distinction should carry into an operator’s own status reports. An expected restoration time belongs beside its owner and the evidence still needed to confirm it. Passing the forecast date should trigger a check, not silently change the ticket to resolved. A store being open would not, by itself, settle the status of every fulfilment service.
Known equipment is not a proven entry path
CERT-FR’s 13 October revision adds Copeland XWEB and Dixell XWEB, and warns campaigns probably continue. Factory reset alone leaves internet-exposed, unpatched end-of-life devices vulnerable. End exposure; reconnect only via a secure VPN or protected network.
Danfoss told AFP most of its affected legacy devices were outside continuing software and security maintenance. It named AK-SM800 and AK-SC355, with obsolete firmware on one version of the former. This does not establish one model, flaw or entry path across all stores. No cited source identifies an attacker, malware, data theft or exact CVE.
A model match is therefore a reason to investigate the local installation, not to invent an exploit chain. The immediate inventory should identify controllers, gateways and monitoring services, with an owner, firmware version, support status and each internet or supplier-network route. Restrict administration to controlled paths and separate monitoring access from control access. These are defensive checks, not findings that every affected retailer lacked them.
Separate a technical restart from an operational release
Consider a hypothetical recovery exercise. The engineering team restores the management service, but the shop’s independent readings do not yet agree with its display. The incident owner should be able to keep that room out of operational use while the discrepancy is checked. A successful administrator login should not approve the stock decision.
Agree the release criteria with engineering, store operations and the food-safety owner before an incident. Record who can approve equipment control, who can decide what happens to stock, and how to escalate when those decisions conflict. This is a proposed acceptance process, not food-safety certification or a claim about the retailers’ actual procedures.
Manual temperature checks and escalation must remain usable when the management layer is unavailable. Preserve controller, gateway, identity and network logs before reset, so restoration does not erase the evidence needed to understand commands and remote sessions. Watch for unexpected defrost commands, set-point changes, disabled alarms and new remote access.
The useful closure record should say which checks passed, which services remain unavailable and which questions are unresolved. That gives the next shift an operating decision it can understand, rather than a green dashboard that it must interpret.
Sources: Intermarché Super Gradignan; AFP, 12 October 2026; CERT-FR, revised 13 October 2026.
