Some time on the night of October 11, 2026, freezers in hundreds of French supermarkets started running hot. Attackers spiked appliance temperatures in hundreds of stores, sparking fires and forcing retailers to throw away spoiled food. By locking the defrost setting on, the attackers pushed some units as high as 122°F (50°C) overnight, with food losses estimated in the tens of millions.
The equipment at the center of the attack was neither obscure nor hidden. Most of the hijacked controllers were end-of-life units that will never receive another patch, and they were reachable from the internet by anyone who went looking. That combination raises a harder question than "how did they get in?" These devices were findable, flagged, and past their support window. So, why were they still connected, and whose job was it to disconnect them?
What we know so far
An ANSSI alert tied the attack to two Danfoss refrigeration management product series, the AK-SC and AK-SM. Danfoss, the Danish manufacturer, called most of the affected equipment legacy products that no longer receive software or security updates. It named its AK-SM800 and AK-SC355 regulators as the systems involved, and said it has long advised supermarkets to migrate to current-generation equipment.
The retailer tallies are large. Les Mousquetaires, which owns Intermarché, said units in roughly 150 of its stores held at 50°C for six hours overnight. At least 100 Coopérative U stores, 80 Carrefour outlets, 30 Monoprix stores, and several E.Leclerc locations were also hit, according to the retailers. The Paris prosecutor's office has described a "large-scale" attack, and investigators are working to identify who carried it out. Separately, France's cybersecurity agency identified a vulnerability in the vendor's software and contacted Danfoss, according to a person close to Prime Minister Sébastien Lecornu.
The attack may not have stopped at the French border. Reuters reported, based on analysis by private security firm Sekoia, that units in Spain, Portugal, Poland, Germany, and Belgium were also affected. Some caution is warranted, as no government has yet confirmed that spread. Attribution is also open. No group has claimed responsibility, and no ransom demand has been reported.
A legitimate feature, not a novel exploit, made it work. "Once control was established," said John Gallagher, Vice President at Viakoo, "they then could use a legitimate function of the system (the defrost cycle) to turn the system from a refrigerator to a heating element."
Everyone could see these devices
The exposure was not secret. While mapping the attack surface on Monday, Predicta Lab CEO Baptiste Robert found 2,752 Danfoss systems reachable online, 1,590 of them in France. Shodan, the search engine for internet-connected devices, tracks more than 4,500 Danfoss devices exposed to the internet.
The warnings were not secret either. Danfoss formally closed out end-of-life for the AK-SM 800 range in June 2023 and pointed customers to its successor, the AK-SM 800A. The company has also published security advisories on its refrigeration system managers since 2023.
In August, researchers at Claroty's Team82 showed how flaws in the AK-SM 800A could let an intruder bypass a login and take control of refrigeration management software, and Danfoss's firmware updates included fixes for those flaws. That research, however, covers the currently supported line, not the legacy AK-SM800 and AK-SC355 units Danfoss says were mostly hit. Investigators have not publicly identified how the attackers got in.
Gallagher has a working theory. In his view, the attackers simply scanned the public internet for Danfoss controllers running end-of-life firmware with weak passwords. Whether or not that turns out to be the exact path, he argues that the exposure data point away from the usual diagnosis. "Malicious hackers using Shodan found these devices in minutes," Gallagher said, "showing that asset discovery and visibility is not the issue, it's automating cyber hygiene."
The gap is enforcement, and enforcement needs an owner
Not everyone puts visibility so far down the list. Louis Eichenbaum, Federal CTO at ColorTokens, argues that organizations need to adopt an "assume breach, assume vulnerable" posture. That starts with knowing exactly which operational assets exist, how they communicate, and which internet exposure can be eliminated. He also cautions that visibility is only the first step, and that tight segmentation and least-privilege access must limit who can reach critical controllers.
The two positions are less opposed than they look. Visibility is necessary, but in this case it was cheap: researchers and attackers could build the same inventory from a search engine. What was missing was a rule that turns knowledge into action. A device that can never be patched leaves two options: isolation or replacement. Gallagher argues for automated policies that either enforce continuous firmware patching or "mandate compensatory network isolation the moment a device reaches end-of-life."
That raises the question of who pulls the trigger. In many cases, it isn't the retailer. A Coopérative U executive explained that its stores do not buy from Danfoss directly but through refrigeration contractors who supply the systems. Those contractors already have remote access: store control panels are typically reachable over the internet so that maintenance companies can adjust them from anywhere. The result is a split in accountability. The vendor declares a product end-of-life, the integrator holds the credentials and the remote access path, and the store owns the inventory that spoils. Nobody in that chain clearly owns the decision to cut the connection.
Eichenbaum's segmentation argument applies here too. "Even if an attacker compromises a workstation, remote access service, or another connected device," he said, "that compromise should not automatically provide a pathway to refrigeration controllers or other critical operational assets." When third parties hold the remote access, that pathway is part of the vendor relationship, and it should be governed like one.
What practitioners should do now
Start by inventorying every building management and OT controller reachable from the internet. Include anything reachable through a contractor's or integrator's remote access, which is often missing from internal asset lists. Then treat end-of-life status as a trigger for action. Isolate a controller past its support date or schedule it for replacement; don't leave it in place indefinitely.
The basics still apply: keep controllers off the public internet, change default passwords at installation, and route remote users through a single managed entry point. Beyond that, audit the credentials integrators hold, and write lifecycle and remote access obligations into service contracts. That way, the next end-of-life notice has a named owner and a deadline.
The pattern extends well beyond grocery aisles. Wherever digital controls drive physical processes, and wherever a third party maintains them remotely, the same gap between knowing and acting exists. As Eichenbaum put it, "our goal must be to ensure that a cybersecurity incident does not become a physical safety incident or a mission-disrupting event."
