Your Fridge Has a Login Page

On the night of October 12, someone turned up the refrigerators at hundreds of French supermarkets. Not by walking into the stores. Over the internet. Cold cases and freezers were driven to 50 degrees Celsius, 122 degrees Fahrenheit, for about six hours. Some units caught fire. Everything on the affected shelves went into a dumpster, and in central Paris one passerby watched staff wheel cartloads of defrosted food to the street with melted ice cream running off the broken tubs.

There was no ransom note on a screen. No files were encrypted. Nobody stole a customer database. The attackers changed a temperature, and a grocery chain lost tens of millions of euros in a single day by its own chief executive's estimate. The Paris prosecutor's office opened an investigation, and the prime minister sent the national cybersecurity agency in to work out how a piece of building equipment became the most expensive thing in the company.

What the Attack Actually Touched

A supermarket cold aisle is not a set of independent fridges. It is one system. A small panel on a wall, usually in a back room, coordinates every circuit in the store, holds the setpoints, logs the alarms and reports upward. Technicians adjust it remotely, because sending a van to every store is not a business model anyone enjoys.

That remote access is the point of the design, and the whole problem. The French agency ANSSI traced the incident to a vulnerability in refrigeration management software from Danfoss, the Danish equipment maker. Danfoss said the units involved were running outdated firmware and that it had long advised customers to stay current and retire legacy hardware.

The spread was wide and boring in the way real incidents are. Around 150 Intermarche stores were affected, Carrefour reported 80 supermarkets, Monoprix about five percent of its roughly 490 stores, and Cooperative U nearly 100 outlets. Sekoia tracked knock-on effects in Spain, Portugal, Poland, Germany and Belgium. About a dozen US military commissaries had refrigeration trouble in late August, and by early November NPR reported the same pattern at retailers from small markets to an IKEA in Sweden, Estonia, Ireland, Luxembourg and the Netherlands.

None of This Needed a Zero-Day

In August, the research team at Claroty published work on the Danfoss AK-SM 800A, the system manager at the centre of installations like these. They found a hidden authentication path the vendor had built for support purposes, which checked a code generated from the device's current date and time instead of the administrator's password. They chained that into a command injection flaw that gave remote code execution, tracked as CVE-2025-41451. They also found a way for an authenticated user to inject directives into the embedded web server's configuration.

The part worth reading twice is what they found before any of that. Searching public scanning services, Claroty located thousands of these management interfaces sitting directly on the internet, no corporate network in the way. Censys counted 2,765 exposed AK-SM 800A devices. An attacker did not need to break into a supermarket. They needed a browser and a search engine.

Danfoss fixed the flaws in new firmware, and R4.3.1 and later ships with tighter package validation and SSH disabled outright. That fix shipped before October. The October attack did not use anything new. It used doors already known to be there and never closed.

This is the pattern that makes operational technology uncomfortable for defenders. There is no malware to detect, because the interface is the login page and the login worked. There is no phishing email to report, because nobody in the store was targeted. The signal comes from the building itself, and only if its own alarms still reach a human.

The Back Room Has Its Own IT Department

Most companies have an asset list. It is a careful record of everything the IT department bought, and it is usually accurate. The building did its own shopping.

Walk a mid-sized office or plant and count the things with an address and a login: the HVAC controller, the refrigeration panel, the camera recorder, the badge system, the door intercom, the boiler, the gate, the printer nobody admits to owning. Each arrived through a facilities budget or a maintenance contract and has been quietly doing its job since before anyone in the room had a work laptop.

They fall outside every normal control by accident rather than design. Patch windows do not apply to a device with no operating system in the usual sense. Multifactor authentication was never offered, because the console was built for a technician on a laptop in 2014. Backups do not cover a compressor. Monitoring covers servers and endpoints, and a fridge panel reports into nobody.

So when the manufacturer publishes a firmware update, the instruction lands in a maintenance agreement whose only line items are parts and labour hours. Somebody has to decide that a refrigeration controller is a security asset, and that decision has no natural home in most org charts.

What It Looks Like From the Owner's Chair

You do not need to know what a PLC is for this conversation. You need to know what is reachable from the internet with your company's name on it, and who answers for it.

SANS surveyed 696 practitioners for its 2026 ICS and OT security report, and the numbers are worth holding onto. Thirty four percent of industrial organizations had at least one cyber incident in the past year, up from 22 percent, the largest single-year jump the survey has recorded. Seventy two percent of those caused facility or system downtime. Detection got slower for the first time since they started measuring it: 41 percent of incidents were caught within 24 hours, down from more than half in the two prior years. Only 13 percent claim full visibility across the kill chain.

Two more findings describe a risk that never appears on a risk register. If their primary automation vendor disappeared tomorrow, 58 percent of respondents said they would be down or unable to operate within a year, and only 20 percent have a working third party risk program. Asked whether they could run critical processes in manual mode past 48 hours, 15 percent said yes, 34 percent partly, 40 percent did not know.

Manual mode is not a plan. It is a group project with a deadline and no rehearsal. The gap between executives and engineers on that question was the survey's headline: those signing off on resilience believed every site could be islanded or run by hand, and the people who would be turning the valves were far less sure.

The Three Controls That Close Most of It

Take the management interface off the public internet. Remote access should run through a gateway that requires authentication and multifactor, with a log of who connected and when. A forwarded port to a controller console is a promise that nobody outside will ever find it, and scanners make that promise weekly.

Give firmware an owner and a date. Write the make, model, firmware version and end-of-support date into the same asset list that holds your laptops, then put the vendor's security notices on a named person's calendar. Treat unsupported hardware as a budget decision with a deadline, not a surprise in October.

Rehearse the fallback while it is still hypothetical. Ask who holds the knowledge that is not written down, what the store or plant does if the vendor is unreachable, and what the alarm path looks like when the panel itself is the thing that is wrong. Then check the alert from that box reaches a person who is awake at two in the morning.

None of this requires an industrial control systems team. A 40-person business can do all three with a spreadsheet, a ticket queue and one honest conversation with whoever holds the HVAC and refrigeration contracts. It is not technical work. It is deciding the equipment belongs on the list.

The Short Version

The French supermarket attack was not exotic. It was a management console, on the internet, running old firmware, with a maintenance path the vendor had built and the customer never audited. Every one of those words describes equipment in buildings most companies have never inventoried.

The internet of things arrived in the back room while everyone watched the front office. The controller does not know it is not a server. It has a login page, a default password and no idea what day it should be patched. It also has the keys to the cold chain, which is a strange amount of authority for a gray box on a wall.

Sources

• Reuters, Hackers heat French supermarket fridges, sparking fires and spoiling food, October 12 2026: https://wmbdradio.com/2026/10/12/french-supermarket-chain-intermarche-hit-by-cyberattack-150-stores-targeted/
• NPR, A new cold war: hackers target fridges across the globe, November 3 2026: https://www.npr.org/2026/11/03/nx-s1-6026676/cold-war-hackers-fridges
• Claroty Team82, Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers, August 9 2026: https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
• Infosecurity Magazine, OT Incidents Hit a Third of Industrial Organizations, SANS Finds, November 11 2026: https://www.infosecurity-magazine.com/news/ot-incidents-third-industrial/
• Help Net Security, CISOs say OT will survive a cyberattack, but their engineers are not so sure, November 12 2026: https://www.helpnetsecurity.com/2026/11/12/sans-industrial-cybersecurity-survey/