Hot Aisles, Cold Facts: The Hidden Devices That Could Be Your Next Breach

In a single night, the chill went out of supermarket freezers across France and the heat went in, as attackers pushed units towards 50°C. The technology at fault was not new or exotic. It was the kind of connected kit that sits in almost every estate, owned by facilities, maintained by a contractor and rarely seen by the security team. For CISOs and heads of security, the real question is not how it happened in a French supermarket. It is whether something similar is waiting in your own organisation.

1. The problem

Overnight on 11 to 12 October 2026, attackers remotely took control of refrigeration controllers in hundreds of French supermarkets and forced them into a continuous defrost cycle, with temperatures reportedly set to 50°C [1][2]. France's CERT-FR reported numerous compromises of Danfoss AK-SM and AK-SC controllers, and on 13 October added Copeland xweb and Dixell xweb devices [3][4]. No group has claimed responsibility and there is no official attribution [5]. These controllers are commonly reachable over the internet so maintenance companies can adjust them from anywhere [6].

Many of you reading this are probably already discussing this at boardroom level to minimise your exposure to these kinds of attacks. The more useful conversation is not about fridges. It is about every internet-connected device that nobody in security is watching.

Ask yourself: what kind of endpoints have you got that you're not aware of?

2. The weaknesses this exposed

Legacy systems nobody retired. Danfoss said most affected units were end-of-life AK-SM800 and AK-SC355 systems that no longer receive security updates, and that newer AK-SM800A units involved were running outdated firmware [2][7].

Exposure at scale. Reuters found at least 4,500 Danfoss controller interfaces viewable through Shodan, and The Register reported more than half of exposed endpoints were in France [5][8].

Third-party dependency. Intermarché said the attack reportedly affected a service provider that manages refrigeration in its stores [9].

A governance gap. CERT-FR was blunt: exposing a management interface to the internet is contrary to good practice [3]. That is rarely a conscious decision. It tends to happen when no one owns the risk.

If this sounds familiar, you are not alone. Many organisations are likely to have legacy operational technology that was installed years ago, connected for convenience and never brought into security scope.

Where does your organisation fit?

Refrigeration is one example. Run a cyber risk assessment across the other connected products in your estate and consider what each could do if exposed or compromised:

• Electronic shelf labels and digital price tags: if tampered with, could cause mispricing, revenue loss or fraud.
• HVAC and building management systems: could affect server room cooling, staff comfort and, in some buildings, safety systems.
• Car park barriers and ANPR: could disrupt access or expose vehicle and personal data.
• Access control and CCTV: could weaken physical security or leak footage.
• Lifts and lighting: could disrupt building operations and accessibility.
• EV chargers: could disrupt charging or provide a route into connected networks.
• Kiosks near point of sale: could become a stepping stone towards payment environments if poorly segmented.
• Cold chain and logistics sensors: could hide temperature failures or corrupt tracking data.

Facilities suppliers and connected devices have been a route in before. In 2013, attackers broke into Target's network using credentials stolen from an HVAC and refrigeration contractor, although that contractor said its connection was for billing and project management, not system control [10][11]. In 2017, Darktrace reported that attackers used an internet-connected fish tank at a North American casino to move data out of the network [12][13].

These systems also sit outside IT. Facilities, estates, operations, finance and legal all make decisions that affect them, from procurement to maintenance contracts. The same pattern could apply in healthcare and pharmaceutical cold storage, hospitality, logistics and warehousing, manufacturing, education and data centres, anywhere connected equipment keeps the business running.

Ask yourself: what are the systems you're not aware of that are sitting cold?

If you want to compare notes with peers facing the same question, our CISO Inspired Summits are a good place to start.

3. The outcomes

The consequences were physical, financial and logistical. The Paris prosecutor opened an investigation into food losses and fires [9][6]. Retailers including Intermarché, Coopérative U, Carrefour, Monoprix and E.Leclerc were affected [14][8]. Les Mousquetaires, owner of Intermarché, said all affected food was thrown away [6], and Groupe Casino said any product whose storage conditions could no longer be guaranteed was withdrawn from sale [1]. Coopérative U said its teams were working with refrigeration specialists to restore the situation [1], and Intermarché said stores were returning to normal gradually [15]. The president of Les Mousquetaires warned of losses running to tens of millions of euros and predicted a legal battle over who carries responsibility [16][17].

Beyond what has been reported, an incident like this typically brings a long tail of work: disposing of large volumes of stock, emergency restocking, staff time spent clearing and cleaning units, empty shelves, knock-on pressure on suppliers and distribution, and insurance claims. CERT-FR's own advice to check insurance terms before cutting contractor data feeds shows how quickly insurance and legal questions arise [3].

Ask yourself: if this happened tonight, who would take the call, and who would carry the liability?

4. Securing these systems at leadership level

Governance and ownership. Agree clear accountability across facilities, IT, security and vendors for every OT and IoT system. Security should set the standard even where facilities owns the asset. Do you know who owns the risk for your building systems today?

Visibility first. Commission discovery of connected OT, IoT and building management systems, including anything reachable from the internet. When did someone last check what your public IP ranges reveal?

Risk register. Record these systems as named risks with an owner, business impact and treatment plan.

Budget for end-of-life replacement. No patch exists for unsupported kit, and CERT-FR warns that a factory reset alone leaves such devices open to reinfection [3]. Build a funded replacement roadmap. How many of your controllers are past vendor support?

Contract requirements. Write security into maintenance and supply contracts: access through a VPN or protected network, changed default passwords and current firmware, all of which CERT-FR recommends [3], plus logging and incident notification. Do your contracts say how vendors reach your equipment?

Board reporting. Give the boardroom a small set of measures: percentage of OT assets inventoried, internet-exposed devices, proportion on supported firmware, vendor accounts with MFA and time to detect configuration changes. Could you show your board those numbers next quarter?

These are exactly the conversations taking place at our CISO Inspired Summits.

5. Does zero trust apply to OT?

Yes, but adapted. Zero trust principles fit operational technology well. The tooling often does not, because many legacy systems cannot run agents or support modern authentication.

• Asset identity: you cannot apply policy to a device you have not identified. Inventory comes first.
• Micro-segmentation: place controllers and building systems in small, tightly defined zones so that one compromised device cannot reach the rest.
• Least-privilege vendor access: named accounts, time-bound sessions and access only to the specific systems a contractor maintains.
• Continuous verification and monitoring: watch for unusual sessions and configuration changes, not just alarms.
• Accepting the limits: where legacy kit cannot be hardened, use network-based controls such as firewalls, secure remote access gateways and passive monitoring, and treat replacement as the long-term fix.

Ask yourself: does your zero trust programme stop at the edge of IT?

Join the conversation

Inspired Business Media hosts CIO and CISO events in London, Frankfurt, Dublin and Manchester.

Our summits are not only about meeting solution providers, taking meetings or attending workshops. They are about discussing pain points like these with other security leaders: seeing where they stand, hearing their perspective on situations like this one, and learning from the experiences and achievements of their careers. It is not just about connecting. It is about having private conversations with people who share your knowledge and understanding, and that is where the real value lies.

They are also a practical way to explore solution providers, with a range of solutions to demo and preview before you make a decision. That can save countless hours of research, and talking it through with peers first helps you pin down your own pain points and needs, so you spend your time where it counts.

If you're interested, take a look at our events calendar to find out more.

Sources

1. SecurityWeek, 13 Oct 2026: forced defrost at 50°C; Groupe Casino withdrew products from sale; Coopérative U working with refrigeration specialists.
2. BFMTV, 12 Oct 2026: date of attack; forced defrost; Danfoss statement on end-of-life and outdated firmware.
3. CERT-FR alert CERTFR-2026-ALE-012: affected Danfoss, Copeland and Dixell systems; internet exposure contrary to good practice; VPN, firmware and default password advice; factory reset insufficient for end-of-life kit; check insurance terms.
4. Le Figaro, 13 Oct 2026: CERT-FR update adding Copeland xweb and Dixell xweb.
5. Reuters via MarketScreener, 13 Oct 2026: no claim of responsibility; at least 4,500 Danfoss interfaces on Shodan.
6. CBC/Reuters, 12 Oct 2026: controllers accessible over the internet for maintenance; all affected Intermarché-group food discarded; prosecutor investigation and fires.
7. Facilities Dive, 13 Oct 2026: Danfoss AK-SM800 and AK-SC355 legacy units.
8. The Register, 13 Oct 2026: more than half of exposed endpoints in France; retailers affected.
9. BleepingComputer, 12 Oct 2026: Intermarché statement on service provider; prosecutor investigation into food losses and fires.
10. Krebs on Security, Feb 2014: Target breach via credentials stolen from HVAC and refrigeration contractor Fazio Mechanical; Fazio statement on billing and project management connection.
11. Reuters, Feb 2014: Target vendor data connection used for billing and project management.
12. CNN, Jul 2017: Darktrace report on casino fish tank compromise.
13. SecurityWeek, Jul 2017: fish tank used to transfer data out of the network.
14. RTL, 13 Oct 2026: retailers affected.
15. Escudo Digital, Oct 2026: Intermarché statement that stores were returning to normal gradually.
16. GovInfoSecurity, 13 Oct 2026: losses of tens of millions of euros.
17. RMC/BFM, 13 Oct 2026: losses estimate; predicted legal battle over responsibility.