On the night of October 11, attackers took remote control of refrigeration at French supermarkets and warmed it up. They did not break the equipment or deploy ransomware. They triggered the built-in automatic defrost cycle, using the controllers exactly as designed, and in some cases drove temperatures as high as 50 degrees Celsius. Stores threw out food. France's finance minister told Parliament that roughly 700 of the country's 10,000 supermarkets were affected; Intermarché reported 150 of its stores hit, Carrefour around 80, and the Paris prosecutor's cybercrime unit opened an investigation.
What was attacked
The target was refrigeration control software from Danfoss, a Danish manufacturer, running on in-store controllers. Danfoss said most of the affected equipment belongs to legacy product lines that no longer receive software or security updates, naming the AK-SM800 and AK-SC355 models in particular. France's national cyber agency CERT-FR subsequently widened the advisory to include Copeland XWEB and Dixell XWEB refrigeration monitoring systems, and warned organizations against exposing equipment management interfaces directly to the internet, recommending they disconnect or restrict remote access.
One honest caveat: the exact entry point has not been confirmed. Neither French authorities nor Danfoss have linked the attack to specific previously disclosed vulnerabilities, and the investigation is ongoing. The defensive lesson does not depend on that detail.
Three ordinary failures, stacked
This is not an exotic attack. It is three mundane conditions that exist in an enormous number of small businesses at once.
Equipment past end of support. The controllers kept doing their job perfectly while the software inside them stopped receiving fixes. A vendor describing a line as legacy with no further security updates is giving you an end-of-life notice in commercial language, and almost nobody reads equipment announcements that way.
A management interface reachable from the internet. CERT-FR's advice points straight at it. Remote management gets enabled during installation because it makes service calls cheaper, and then it stays on, facing the entire world, for a decade. This is the same root cause as the MikroTik router flaw and most appliance incidents we have covered this autumn.
Vendor remote access nobody inventoried. The equipment was almost certainly installed and maintained by a refrigeration contractor, not by anyone in IT. Whoever manages your coolers probably has a remote path into them, and that path is almost never on anybody's list of systems.
Why a small business should care
Because the pattern is not about supermarkets. Any business with internet-reachable operational equipment has the same exposure: restaurant and grocery refrigeration, a clinic's vaccine or sample fridges, HVAC controls, door access systems, security cameras, digital signage, point-of-sale hardware, irrigation, even the building's water heating. These devices are installed by trade contractors, managed through a vendor portal, and treated as appliances rather than computers. They are computers, on your network, with a route in from outside.
The damage here was also not an IT problem in its consequences. It was spoiled inventory, lost trading, disposal costs and a conversation with an insurer about whether spoilage from a cyber incident is covered. That is worth checking in your own policy before you need to know.
What to actually do
- Walk the building and list the connected equipment. Anything with a power cord and a network or cellular connection goes on the list, including the things a contractor installed. Most businesses find two or three they had forgotten.
- For each one, ask who can reach it from outside. Which vendor, through what portal, with whose credentials, and does that access still need to exist.
- Get management interfaces off the open internet. If remote service access is genuinely needed, it should come through a VPN or an allow-listed address, not from anywhere on the planet.
- Put operational equipment on its own network segment, so a compromised controller cannot reach your files, and your office network cannot reach the controller either.
- Ask your maintenance vendors the end-of-support question in writing. Is this model still receiving security updates, and if not, what is the replacement path and cost.
- Check what your insurance covers. Spoilage, business interruption and equipment damage arising from a cyber incident are not always inside a cyber policy or a property policy.
The takeaway
The most useful thing about this incident is how boring the causes are. Unsupported firmware, a management port open to the internet, and a vendor connection nobody tracked. None of that needs a security budget to fix, it needs a walk around the building with a notepad and a few uncomfortable questions to the contractors who installed your equipment. The businesses that will be surprised by the next one of these are the ones who still think the fridge is not a computer.