Hackers Pushed French Supermarket Freezers Past 100°F. A Cyber Executive Says U.S. Utilities Share the Weakness

A cyberattack on French supermarkets has spoiled food worth millions of dollars. A cybersecurity executive says the same weakness is sitting inside American water, power and food systems.

Unknown hackers took over refrigeration at hundreds of supermarkets in France and raised temperatures above 100°F overnight, according to the account John Walsh gave Fox News Digital. The chains hit include Intermarché and Cooperative U. A photo from Intermarché in Névez, western France, dated Oct. 12, 2026, shows empty fresh-food refrigerators after the defrosting.

Nobody has publicly identified who did it.

Old equipment, no updates

Danfoss, the Danish maker of commercial refrigeration systems, said many of the affected units were legacy systems that no longer receive software updates. That is the detail Walsh seized on.

Walsh is senior vice president and field CTO for government and critical industries at IGEL, a Germany-based software company. He works with governments and with companies that build and deploy critical infrastructure, among them Siemens and Rockwell, on operational security.

"A primary obstacle in [operational technology] environments, whether in food manufacturing, pharmaceuticals, oil, or utilities, is that facilities operate assets that are 15 to 20 years old," Walsh said. "These systems are expensive, fragile, and essential to ongoing operations."

He said decision makers at the companies he works with resist taking key systems offline to upgrade or secure them. Their attitude, in his words, is "if it's not broken, don't fix it."

The warning for U.S. operators

Walsh said the French incident should alarm American businesses, and that the exposure goes well past grocery stores.

"Think about if we don't have water for seven days, or if they attack freezers and we don't have food," he said. "That's a tough situation for people to live through, and it could create a lot of economic and social unrest. We're seeing that we're vulnerable and that attacks are taking systems down."

He pointed to a 2026 coordinated attack on Minnesota water systems as evidence that U.S. infrastructure is already being probed. Walsh also said incidents in France, the United States and the United Kingdom suggest adversaries may be rehearsing their methods on real targets. That is his reading. No investigating agency cited in the reporting has confirmed that link.

Assume the attacker is already there

Walsh's central argument is that the security model has to change. Trying to wall off legacy systems completely no longer works, he said, because AI is making hackers more capable.

"We're moving from a thought process of security to resilience," Walsh said. "Security is kind of like, 'I feel I can trust that things are okay.' Resilience is where you make the assumption the attacker is present, where, when the attacker is present, you control the blast radius."

The "Trojan horse" scenario he describes is a dormant intruder sitting inside a network such as the power grid and waiting to be activated. He offered no evidence of such an intruder in a specific U.S. utility. It is a planning assumption, not a confirmed finding.

What the facts do and do not show

The French attack is documented: refrigerated food was lost, the hardware was old, and the manufacturer has said so. The leap from French freezers to a U.S. grid failure is Walsh's warning. It is not a reported event.

Walsh also has a professional stake. His company sells security work to the operators of these systems, and a push for more spending on resilience benefits firms like his. That does not make him wrong. The 15-to-20-year equipment lifespan he describes, and Danfoss's own statement about unpatched units, are the kind of facts operators can check against their own plants.

The cost problem is real on both sides. Replacing or patching operational technology means downtime for systems that run food, water and power around the clock. Operators who skip the upgrade are betting that nobody will bother to attack them.

The French incident suggests somebody did.

Who is responsible remains unknown. No group has claimed responsibility, and no government has publicly named a suspect. Until someone does, it is unknown whether the freezer attack was criminal extortion, a state-backed test run, or something else. The answer decides whether U.S. operators are facing opportunistic hackers or an adversary building a capability.