This past October, the manager of an Intermarché in Normandy arrived to find his freezers at 40°C and a ventilator in the fish cold room at 70°C. Monitoring teams had alerted him to temperature irregularities earlier that morning, and the equipment was running again later that day. Bloomberg reported that he threw out all of his fresh food anyway, €3,000 worth, "I didn't want to take any risks since the cold chain had been broken".
He was one of hundreds of store managers who faced the same decision. Overnight on October 11-12, attackers took control of internet-connected controllers that run refrigeration equipment in French supermarkets and forced units into prolonged defrost cycles. Fridges and freezers reached as high as 50°C, and stock spoiled, resulting in food losses estimated in the tens of millions of euros. A report published by the French government on November 9 identified around 700 retail sites and at least 15 fires. Small butcher shops, a slaughterhouse and food-processing plants were also affected.
On November 9, France attributed the attack to a cyber unit affiliated with Iran's Islamic Revolutionary Guard Corps. The Paris prosecutor opened a judicial investigation, and Iran's foreign ministry denied responsibility. Meanwhile, overnight from November 1-2, supermarkets in Belgium, Sweden, Ireland, Luxembourg and several other European countries reported their fridges and freezers warming in the same way.
To my knowledge, no Canadian grocer has reported a comparable attack, but Canada has seen a version of this. In October 2025, the Canadian Centre for Cyber Security (the "Cyber Centre") issued an alert on hacktivists tampering with internet-exposed control systems. One of the incidents it described was a grain drying silo on a Canadian farm, where temperature and humidity had been manipulated. The Cyber Centre said the interference could have created unsafe conditions if it had not been caught in time.
Much of what has been written since October has understandably concerned securing the equipment: patch the controllers, take them off the open internet, replace the ones that no longer receive updates. I'll come back to that at the end. And since November 9, the coverage has been about Iran, which matters for diplomacy, for the criminal investigation and (as it turns out) for insurance. But neither the cyber security advice nor the attribution is where a Canadian grocer, distributor or processor would have to start if this happened here. If we put ourselves in the shoes of the manager in Normandy, the first question they would have to answer for themselves that morning would be: what are we going to do with all this food?
Where to Start if Canadian Freezers Run Amok?
In Canada, we have a complex system of food laws that differ from province to province, and a number of federal statutes that apply in certain circumstances. The one that applies to nearly everyone who sells food in Canada, licensed or not, is the Food and Drugs Act (“FDA”). And section 4(1) of the FDA prohibits the sale of food that, among other things, is unfit for human consumption or "was manufactured, prepared, preserved, packaged or stored under unsanitary conditions." Section 7 separately prohibits storing food for sale under unsanitary conditions.
I realize that "unsanitary conditions" sounds like dirt, and partly it is. The definition in section 2 is wider: "such conditions or circumstances as might contaminate with dirt or filth, or render injurious to health, a food". The operative word here is "might" and, for this part of the prohibition, the question is whether the storage conditions might have made the food harmful; proof of actual harm is not required. The store manager doesn’t have to decide whether the food was harmed - they have to decide whether the conditions it was held under might have made it harmful. A display case or cold room that was meant to keep food frozen or chilled for safety, and instead spent the night at 40°C, is, I think, squarely the kind of circumstance that definition describes.
The FDA also defines "sell" broadly. It includes having food in your possession for sale and distributing it, whether or not the distribution is for consideration (giving it away counts). A warehouse that is merely holding food for sale is captured as well.
Provincially, we see prescribed temperature limits come from food premises rules. In Ontario, the Food Premises regulation under the Health Protection and Promotion Act provides that potentially hazardous food "shall be distributed, maintained, stored, transported, displayed, sold and offered for sale only under conditions in which the internal temperature of the food is" 4°C or lower, or 60°C or higher (s. 27(1)). The regulation allows up to two hours outside those limits, but only for periods "necessary for the preparation, processing and manufacturing of the food" (s. 27(2)(a)). I think we can safely say that exception does not provide a general two-hour grace period for refrigeration failures. Food intended to be sold frozen must be kept frozen until it is sold or prepared for use (s. 28). These are Ontario rules, but there are similar rules in most provinces.
Not everything in a refrigerated case is potentially hazardous food. Ontario defines the term as food "in a form or state that is capable of supporting the growth of infectious or toxigenic micro-organisms and which requires time and temperature control to limit such growth." Raw meat, fish, many dairy products, and prepared foods are the obvious concerns. And most municipalities or regions have a public health or food safety team that can tell you, in their view, what else falls inside the definition. It’s worth noting that businesses and regulators do not always take the same view of risk.
So, can you still sell the food from your hacked fridges and freezers? Sometimes, maybe. None of these rules says food that has been above 4°C can never be sold. The Ontario limits are about how food is held. Federally, what you can't sell is food that is unfit to eat, or that was held in conditions that might have made it harmful.
Fish and meat held at 50°C doesn’t take much analysis. Nobody needed a lawyer to tell them to empty a freezer that had been sous-viding overnight. A more challenging example came from Belgium, where local media reported that fridges had been turned up to 17°C. Chilled product held at 17°C for a few hours can look and smell normal. Whether those products can still be sold depends on what the food was, how warm it became and how long it remained there. The FDA does not supply a universal table of permissible hours and degrees, so the business must make a defensible assessment and be able to explain it. That starts with reliable evidence of time and temperature.
Where do Cold Chain Records Come From?
In many stores, cold chain records come from the refrigeration system units themselves. The controllers attacked in Europe belong to systems that let store staff or a refrigeration contractor watch case temperatures around the clock and change settings remotely. In the affected systems, the remote-access interfaces were exposed to the internet. For many businesses, the same system is also where the temperature history lives.
So, let’s return to the example of our butcher, or store manager on the morning after. They arrive and the device that tells them how warm the freezer got, and for how long, is the same device that someone else was operating overnight. A Belgian butcher who lost about €15,000 of meat in the November wave told Reuters: "They are hacking the system that is doing the registration of the temperature, and they can program it at a distance."
The Paris prosecutor who is investigating this issue has said that the attackers in France did more than run the defrost. They also switched off the alerts that temperature probes were meant to raise above a set threshold. Nothing I have read says that anyone altered stored temperature logs, but keeping the food takes more than knowing that something went wrong. It takes an accurate account of the cold chain: how warm each case got and for how long, from a device that you now have good reason to doubt.
The most practical answer during this cyber-insecure moment is a second record that doesn't run through the controller. Standalone data loggers in cold rooms and cases, or documented readings taken by hand with a probe thermometer, can provide evidence independent of the compromised controller. Manual readings establish temperatures at the times taken; they do not reconstruct what happened between readings. IfIf you have independent, reliable temperature records, you can make a borderline decision on evidence. If you don't, the cautious answer is the one the Normandy manager reached.
Ontario already requires refrigeration equipment holding potentially hazardous food to "contain accurate indicating thermometers that may be easily read" (O. Reg. 493/17, s. 30(b)). If those thermometers work independently of the controller, readings taken from them regularly and written down can contribute to that independent record. If they only display what the controller reports, they aren't.
Where the establishment requirements of the Safe Food for Canadians Regulations (“SFCR”) apply, a cooling system must already "function as intended" and, where necessary to prevent contamination of food, have instruments that "control, indicate and record" its temperature and humidity levels (s. 65(2)). Those are the jobs the attacked controllers were doing. Licence holders must also generally keep a written preventive control plan (s. 86), and section 89(1)(c) requires the plan to include, among other things, "the procedures for monitoring the critical control points in relation to their critical limits" and "the corrective action procedures for each critical control point." Where refrigerated storage is one of your critical control points, it's worth asking whether your monitoring procedure takes it for granted that the controller can be trusted, and what your corrective action procedure says if it can't.
What if the Food has already left
In the November wave, the Swedish retailer Axfood said freezers at a distribution centre for home grocery delivery in Gothenburg were hacked. If a distribution centre has already shipped product from freezers like those in the Axfood attack, then it should be thinking about a recall, not only about what to throw out.
In Canada, if you hold a Safe Food for Canadians licence, the regulations add duties of their own. They apply to "operators" - broadly, licence holders - in respect of food that is to be exported or sent to another province, and to import licence holders for the food they import (ss. 45, 46(1) and 85). Under section 82, an operator who "suspects on reasonable grounds that a food presents a risk of injury to human health" must immediately investigate. If the investigation establishes that risk, the operator must immediately notify the Minister (in practice, by notifying the Canadian Food Inspection Agency) and immediately take action to mitigate it. In this case, the trigger is “reasonable suspicion” and not a positive test result. So, the reasonable licensed entity would probably treat a load shipped from freezers that had been under an attacker's control as grounds to investigate.
Section 84 of the SFCR requires every operator to keep a recall procedure and to conduct a recall simulation at least once every 12 months. If the operator determines that a food should be recalled because it presents a risk of injury to human health, it must immediately notify the Minister and immediately implement the procedure.
And if you don't hold a licence (a business that only stores and ships food may not need one), remember that certain federal laws still apply: the Food and Drugs Act prohibition covers distribution. If you send the food across a provincial border, or import or export it, the SFCR's trade rules apply too, licence or not. One of them is that the food "must have been manufactured, prepared, stored, packaged and labelled under sanitary conditions" (s. 8(1)(d)). The SFCR defines a sanitary condition as one that "does not present a risk of contamination of a food". As under the FDA, regulated parties are required to undertake and provide an assessment of risk. And section 19 of the Canadian Food Inspection Agency Act lets the Minister order a recall by notice served on "any person selling, marketing or distributing the product". The test there is whether the Minister believes on reasonable grounds that the product poses a risk to public, animal or plant health.
Public Warnings
On October 21, the director general of France’s national cyber security agency, ANSSI, told a French Senate committee that, based on the agency's current analysis, the vulnerabilities researchers had published over the previous two years were not the ones exploited. The attackers relied on elementary security failures instead: refrigeration equipment exposed directly to the internet, administered without particular safeguards and protected by weak passwords. The November 9 report names no vulnerability either. It says the attackers used a scanning tool that searches for devices connected to the internet.
The Cyber Centre had warned Canadians about that kind of exposure twice. Its October 2025 alert, the one that described the grain silo, advised organizations to inventory their internet-accessible control systems and, where possible, to reach them through a VPN with two-factor authentication rather than leave them directly exposed. Then, in March 2026, after the start of the Iran conflict, the Centre published a threat bulletin telling Canadian critical infrastructure operators to "remain vigilant". Iranian actors, the bulletin said, "opportunistically identify targets using publicly available scanning tools to search for internet-exposed systems with vulnerable configurations, for example devices using default or weak passwords and without multi-factor authentication."
The Cyber Centre had also relayed advisories from the U.S. Cybersecurity and Infrastructure Security Agency ("CISA") including vulnerabilities in the controllers themselves. So, Canadians were publicly warned months before either wave.
These warnings can be the cause of significant consternation when someone later asks whether you took reasonable care. It might be an inspector, or a customer whose product you were storing. Insurers are particularly good at asking these questions. I’m not an expert in insurance coverage, so what I’m learning from the French experience is that French cyber policies typically don't cover physical losses such as spoiled food, and that claims could be affected where stores had not installed the latest software updates. Reuters reported that an underwriter indicated that a state actor's involvement could complicate claims too, because cyber policies typically do not cover acts of war. France now says a state was involved. The effect on coverage will depend on the wording of the particular policy and exclusion.
I’ll leave the coverage analysis to insurance specialists, I can say with confidence that this is all a mess worth avoiding. And for everyone, it's worth knowing who’s responsible for what (typically in a refrigeration service agreement) and confirming who is responsible for firmware updates and passwords, and how the system may be reached remotely.
Canada’s new Critical Cyber Systems Protection Act does not resolve these food safety questions either. It was enacted this year and is not yet in force. Food is not among the vital services and systems currently listed in its schedule. The food safety obligations discussed here already exist.
What do we do with this?
I think there are three actionable things worth doing sooner rather than later, whether or not an attack reaches Canada.
I would start with the refrigeration contractor. Get written answers about which controllers can be reached remotely, how that access is protected and who maintains it. Confirm that the equipment still receives security updates and that someone is responsible for installing them. The November 5 fact sheet from CISA, the FBI and their federal partners provides a useful checklist for that discussion.
Then examine the temperature records and the response procedure together. Establish what independent evidence would survive a compromise of the controller, whether it covers the periods when nobody is on site, and who will decide whether affected food can be retained. For businesses conducting recall simulations under the SFCR, this would be a useful scenario for the next exercise.
Ask the insurance broker to identify where cyber-related spoilage is covered in the policies actually held, and where exclusions or limitations leave a gap. Include the treatment of attacks attributed to foreign states. Businesses storing food for others should also review the allocation of temperature losses in their storage agreements.