Last week, hackers accessed the refrigeration controls of Intermarché supermarkets across France, turning up the heat and destroying thousands of tons of food, as well as causing several fires. In a Q&A with InternetRetailing, Tom Hegel, distinguished threat researcher and research lead at SentinelOne, explains why he thinks the attacks could potentially be the work of a hostile state.
Q: What makes you think the Intermarché refrigeration hack was state-backed?
A: I’d call it a working theory at this stage. What points that way is what’s missing. Nobody has asked for a ransom, and no hacktivist group has come forward to claim an attack that hit hundreds of stores, which would be a huge publicity win for one. Switching fridges off overnight across several chains at once fits the cheap, deniable disruption Europe has been dealing with for years. Until French investigators publish their findings, I’d hold any attribution loosely.
Is it possible to speculate which hostile state might be responsible for the attack?
There is not enough public evidence to name a most likely state, or even establish that this was a state-directed operation yet. Russia’s documented record of sabotage in Europe makes it a reasonable hypothesis to investigate, but that history does not link Moscow to these attacks.
Chinese state groups have established persistent access to critical infrastructure that we assess is intended to support future disruption. Iran-linked actors have also targeted exposed industrial controllers, including at US water facilities. Those precedents show that several states have relevant capabilities, but they do not establish responsibility for the newest refrigeration attacks.
The reported security weaknesses also mean we should keep non-state actors in scope. Poorly protected, internet-accessible refrigeration controls could put disruptive capabilities within reach of criminals, hacktivists or independent attackers. Significant physical damage does not necessarily require a sophisticated operation or state backing. We need evidence connecting this specific activity to an actor before calling any country the most likely culprit.
How do these kind of hackers operate? Do they work directly for hostile states, or for wider criminal groups?
States don’t always send their own officers to do this work directly. We have traced some “hacktivist” personas back to state military units and state-sponsored organisations. That setup keeps the state at arm’s length and gives it someone else to blame. For an attack like this one, the skill needed amounts to logging into a control panel someone left online.
What is the end game in attacks such as these which target retailers? What are the hackers hoping to achieve?
Psychological impact is the main objective, which can lead to general civil unrest, political discourse, and overall create domestic chaos. Unreliable food supply at scale wears down confidence in the companies and in the government’s ability to protect them. Food security becomes a serious worry if attackers move on to distribution centres or keep systems down for days. Hostile states also learn where the breaking points are by watching how everyone reacts.
How do hackers target retailers through suppliers?
Most supermarkets hand refrigeration to specialist contractors, who log in remotely to adjust settings without visiting each store. Intermarché has said the attack appears to have affected a service provider that manages refrigeration in its stores. Getting into one contractor’s remote access tool, or stealing a password it shares across clients, can open up every retailer on its books at once.
Several chains going down on the same night suggests a route like that, though investigators are still to confirm how it actually happened.
Has AI made the situation worse – does it leave retailers more open to this kind of exploitation?
AI speeds up the groundwork and potential scale of such cases. An attacker can use it to sift scan data for exposed controllers and work out how to operate unfamiliar IT gear from its manuals. This attack needed none of that, since the panels were sitting online running old firmware. AI tools inside retail, from pricing engines to customer service agents, add new ways in, and each needs the same access controls as any other software. Anything connected can be abused if it’s left open.
How can British retailers protect themselves?
Start by finding every device that can be reached from the internet. Refrigeration and building controllers should come off the public internet, with vendor access routed through gateways that require multi-factor authentication.
Contracts with maintenance firms should spell out their security duties and give the retailer a right to audit them. Units that no longer get security updates need careful access considerations or replacing.
What could or should the British Government be doing to help protect against such cyberattacks in the UK?
Food already counts as critical national infrastructure in the UK, and the Cyber Security and Resilience Bill brings managed service providers into scope. Covering the contractors who run refrigeration and building systems would close a large gap. UK product security law sets rules on default passwords and updates support for consumer gadgets, and commercial controllers sold to businesses deserve something similar. The NCSC could scan for exposed industrial interfaces and warn owners directly. A general approach forward is we need to be more proactive, as cases like this will only increase with the general availability of discovery and abuse via AI tools.
Stay informed
Our editor carefully curates two newsletters a week filled with up-to-date news, analysis and research. Click here to subscribe to the FREE newsletter sent straight to your inbox. Why not follow us on LinkedIn to receive the latest updates on our research and analysis?
