İsmail Şahin - In France, hackers attacked the cooling systems of supermarkets. In the cyber attack carried out on the night between October 11 and October 12, the systems managing the refrigerators, freezers and cold storages of many supermarkets were remotely compromised. The pirates activated the “defrost” function, raising temperatures to as high as 50 degrees in some spots. It was recorded that the temperature in one store reached 80 degrees and the equipment melted.
According to initial statements, 490 stores belonging to six chain markets were affected by the attack. It is estimated that the number may exceed 500.
Damage will reach millions
The total cost of the attack has not yet been disclosed. However, preliminary calculations indicate that the damage is at least several million euros; It points out that if cold storage users outside the store are also affected, it could be tens of millions of euros. It was stated that product loss in a Super U in Wasselonne reached 220 thousand euros. Intermarché management in Marmande also announced that the value of the destroyed food was more than 75 thousand euros.
Some stores closed temporarily to unload products and have systems checked. Businesses also faced additional costs such as technical service, fault detection and cleaning. The possibility that insurance policies may not cover such cyber-related store losses has become one of the important problems faced by the industry.
Old devices became targets
Speaking to the French press, cyber security expert Marta Rybczynska pointed out that some of the vulnerabilities used in the attack have been known for a long time and commented, "Even a somewhat talented high school student could theoretically carry out such an attack." According to Rybczynska, the main problem is that some devices continue to use outdated software.
It was determined that the common point of the attack was the cooling control systems of the Danish manufacturer Danfoss. Danfoss reported that most of the affected devices are older products that have not received software and security updates.
Some previous attacks
In the attack in France, hackers directly manipulated the physical system. Most previous attacks had crashed companies' computing, payment, ordering or logistics systems.
■ Electricity distribution companies in Ukraine were the target of cyber attacks on December 23, 2015 and December 2016. There were power outages.
■ The attack on the fuel distribution system in Iran on October 26, 2021 and December 18, 2023 disrupted services.
■ On May 7, 2021, in the USA, Colonial Pipeline, which carries approximately half of the fuel consumed on the east coast of the country, was attacked. The company ceased pipeline operations.
■ On February 21, 2024, there was a cyber attack in the USA that disrupted prescription and insurance transactions in pharmacies.
■ On September 19-20, 2025, the attack on the MUSE software used in passenger transactions of the aviation technology company Collins Aerospace caused disruptions at Heathrow Airport in London and Brussels, Berlin, Dublin and Cork airports.
If it happens in Turkey...
The Cyber Security Presidency was established in Turkey on March 12, 2025. Subsequently, Cyber Security Law No. 7545 came into force. 15 sectors, including energy, finance, healthcare, manufacturing and transportation, were designated as "critical infrastructure". With the decision taken at the Cyber Security Board meeting held on May 5, 2026, the "food and agriculture" sector was included among the critical infrastructure sectors in terms of cyber security. New legal regulations that came into force have made cyber security an operational necessity.
Sanctions in law
The most notable sanctions in the law are:
■ Those who attack the cyber elements that constitute Turkey's national power will face a prison sentence of 8 to 12 years.
■ The penalty for those who spread, share or sell the data obtained as a result of these attacks will be imprisonment from 10 to 15 years.
■ Administrative fines ranging from 1 million TL to 100 million TL may be imposed on companies that do not fulfill their cyber security obligations.
Password warning
Cyber security company manager Akgün Yardimci also said the following about the precautions that can be taken: "No unnecessary system should be accessed over the internet. If access is necessary, multi-layer authentication should be a must for accessing management interfaces. Passwords that comply with the standard we call complex passwords should be used."
Additional liability
It is expected that additional cyber security measures and obligations will be brought to the agenda for businesses in the fields of food production, storage, distribution and retail in the coming period.
70 percent of them are in Istanbul
Although the cyber security cluster in Turkey was established administratively in Ankara under the coordination of the Presidency of Defense Industries, the commercial cyber security market, R&D companies and most of the investments are clustered in Istanbul.
