Hackers Turned Supermarket Freezers Into Ovens. Here's What That Means for Every Business With Physical Systems.

On the night of October 11, 2026, attackers didn't breach a database. They didn't steal credentials. They didn't encrypt files and demand ransom.

They turned supermarket freezers into ovens.

Across hundreds of French retail locations — Intermarché, Carrefour, Coopérative U, Monoprix, E.Leclerc — attackers remotely seized control of refrigeration management systems and drove temperatures to 50°C. Frozen goods defrosted. Refrigerated products spoiled. Intermarché said its affected stores had to throw away everything inside the affected units. The head of Les Mousquetaires group estimated losses of tens of millions of euros across France.

The device at the center of it: a refrigeration controller made by Danish company Danfoss, used by maintenance firms to manage all of a store's fridges and freezers remotely. CERT-FR, France's national cybersecurity response team, confirmed it on October 12. ANSSI — France's top cybersecurity agency — called it urgent to take the affected units off the internet immediately.

By October 13, the attack had reportedly spread to Spain, Portugal, Poland, Germany, and Belgium. A Paris criminal inquiry was underway.

This is not a story about French supermarkets.

The Real Story: Physical Systems Are the New Attack Surface

Here's what business leaders need to understand: the Danfoss attack is a preview, not an anomaly.

For years, we've talked about cyber threats in terms of data — stolen records, leaked emails, compromised accounts. But increasingly, the most damaging attacks aren't going after your data. They're going after your operations.

The Danfoss controllers that attackers hijacked are a category of device called Operational Technology — OT. These are systems that don't just process information; they control physical things. Temperatures. Pressures. Valves. Conveyor speeds. HVAC systems. Building automation. Manufacturing lines.

And here's the uncomfortable truth: most organizations have no idea how many of these systems are connected to the internet, who is responsible for securing them, or whether they've ever been patched.

Danfoss itself acknowledged that most of the affected units were older models — the AK-SM 800, declared end-of-life in May 2021, and the AK-SC 355, phased out in 2016. Neither product receives security updates anymore. Some current-model AK-SM 800A units were also hit, running outdated firmware.

Thirty-two French retail chains didn't make a reckless security decision. They inherited devices from refrigeration contractors, those devices aged out of vendor support, and nobody had a clear owner responsible for what happened next. That's not negligence — it's the norm.

The Pattern Is Already Here

If this feels like a distant, edge-case problem, consider how quickly this category of attack has escalated:

Last August, the FBI and U.S. Coast Guard boarded a supertanker after attackers compromised its engine room controls and cut communications for 30 hours mid-voyage. In August 2026, a five-agency joint advisory warned that AI-generated exploit scripts were actively targeting industrial PLCs at U.S. water, energy, and manufacturing facilities. In August 2025, Boston Scientific disclosed a cyberattack that shut down global operations — they couldn't process or ship pacemakers.

Attackers targeting physical control systems used to require nation-state resources and highly specialized expertise. That barrier is collapsing. The Danfoss attack required no zero-day vulnerability. CERT-FR hasn't even named how the attackers got in. The likely answer: internet-exposed management interfaces with weak or default credentials on devices that haven't seen a security update in years.

That's not a sophisticated attack. That's opportunity.

What Business Leaders Must Ask

You don't have to run a supermarket to face this class of risk. If your business depends on any of the following, this problem belongs to you:

- HVAC and building automation — most modern systems are remotely managed and internet-accessible - Manufacturing equipment and PLCs — production lines with remote monitoring capability - Cold chain and logistics — temperature-controlled warehousing and transport - Healthcare equipment — medical devices, lab equipment, facility controls - Retail point-of-sale and back-of-house systems — often managed by third-party service providers - Energy and utilities infrastructure — generation, distribution, metering systems

Here are the three questions I ask every business leader when we talk about OT risk:

First: Do you have a complete inventory of your connected physical systems? Not your IT systems — your physical ones. Can you name every device in your building, your warehouse, or your facility that has a network connection and can be accessed remotely? Most organizations cannot. If you can't see it, you can't protect it.

Second: Who is contractually responsible for patching and updating those systems? The Danfoss situation is instructive: the retail chains weren't Danfoss customers directly. They were customers of refrigeration contractors who supplied them with Danfoss systems. When the vendor declares a product end-of-life, who in your organization knows? Who is responsible for the decision to replace it? If the answer is 'I'm not sure,' you have a governance gap that attackers will eventually find.

Third: Are any of those systems directly internet-exposed? CERT-FR's first instruction was categorical: disconnect affected controllers or filter access to them immediately. Exposing management interfaces to the open internet goes against basic security practice — and yet it remains extraordinarily common for OT systems managed by outside service providers. Your IT team may not know these interfaces exist. Your facilities team may not know they're a security concern. That gap is the attack surface.

The Patch Problem Is Different for OT

One more thing that makes OT security fundamentally different from traditional IT security: you often can't just patch your way out.

The AK-SM 800 and AK-SC 355 don't get patches. They're end-of-life. For those systems, CERT-FR's only real answer is: replace them. That takes time, money, operational planning, and contractor coordination — not a rushed Tuesday morning patch deployment.

For systems that can be updated, the picture isn't much better. Many OT environments can't tolerate the downtime that patching requires. A manufacturing line that runs 24 hours a day, a hospital HVAC system, a cold storage facility — these aren't environments where you can schedule a maintenance window the way you would for a laptop.

This is why the first line of defense for OT systems isn't patching. It's network segmentation and access control. Remove direct internet exposure. Require remote access to go through a controlled, authenticated, auditable entry point. Limit which IP addresses can reach management interfaces. These are architectural controls that don't require downtime — and they would have stopped the Danfoss attack cold.

The Business Calculus

Tens of millions of euros in spoiled food. A criminal inquiry. Five European countries affected. A national cybersecurity agency declaring an emergency.

All of it traced back to refrigeration controllers that maintenance firms could reach from the internet.

The lesson isn't that Danfoss controllers are dangerous. The lesson is that any connected physical system with remote access capability is an attack surface — and most organizations have dozens of them they can't fully account for.

Cybersecurity used to mean protecting your data. Increasingly, it means protecting your ability to operate.

If you're not sure how many connected physical systems your organization has, who owns their security, or whether any of them are directly internet-exposed — now is the right time to find out. Before someone else does.