The supermarket fridge is probably the dullest machine in any store. It hums, it stays cold, and nobody gives it a thought until the milk goes sour. On the night of 11 October 2026, it became the most talked-about machine in France.
A login page in the wrong place
Overnight, someone accessed the refrigeration controllers of hundreds of French supermarkets and switched fridges and freezers into defrost mode. By morning, units in Intermarché, Carrefour, Coopérative U, Monoprix and other stores had climbed to around 50°C. Later estimates put the toll at 250 to 350 stores. Stock went straight into skips, and in some shops the heat damaged equipment or started fires, with sprinklers adding water damage on top.
Three weeks later, on 2 November, a second wave hit more than 115 stores in Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia.
The method was almost embarrassingly simple. The targets were Danfoss controllers, along with Copeland and Dixell supervisors, whose web management interfaces sat on the public internet so maintenance contractors could adjust temperatures without driving to the store. Danfoss said the affected French stores were running outdated firmware, and several of the targeted models had reached end of life with no further security updates. Back in August, Claroty had published research on the Danfoss controllers describing a daily-code authentication mechanism that could be abused to bypass the normal login. Investigators also observed that the attackers did not appear to deploy any malicious code. They used the interface the way the technician uses it, only from somewhere else.
Ownership adds another layer. Many French retailers outsource refrigeration to third-party firms, which means the store manager often has no say over the security of the box that keeps their stock alive. Supply chain risk rarely gets more literal.
The warning arrived the next morning
France’s CERT-FR, part of ANSSI, published an alert on 12 October, the morning after the first wave, and updated it on 13 and 16 October. It named the affected product lines and told operators to remove them from the internet, move contractor access behind a VPN, check setpoints and defrost schedules, change default passwords and replace end-of-life units. It also warned that the campaign was probably still running.
Greece’s National Cyber Security Authority moved two days later. On 14 October it reported more than 300 exposed refrigeration controllers in Greece from Danfoss, Copeland/Dixell and Carel, and asked operators to disconnect the controllers from the public internet, allow remote access only through VPN with multi-factor authentication, change default credentials, patch, and retire unsupported equipment. After the second wave, on 3 November, the ΕΑΚ wrote to the Hellenic Supermarket Association to repeat the message. Greece had not escaped entirely: a butcher’s shop in Kifisia reported its refrigeration set to 150°C, with similar reports from smaller stores nearby.
So who listened? Censys tracked the two controller families named by CERT-FR and found that internet-exposed hosts fell 53%, from 6,695 to 3,124, between 9 October and 5 November. That is real progress, and it also means roughly half were still reachable after national alerts and an incident making the headlines across the continent. In Belgium, the head of refrigeration firm Sabcobel said most stores had taken measures after the French attack; the few that had not were the ones hit.
The second wave landed 21 days after CERT-FR’s first alert. Attackers read advisories too, and every advisory doubles as a target list for anyone who has not yet acted.
Habit, as I have argued before, is one of the defender’s most stubborn enemies. A fridge that has worked for twelve years does not feel like a risk, so the email from the authority goes into the same pile as the energy audit.
From spoiled yoghurt to frozen plasma
Overnight between 1 and 2 November, three cold-storage sites of the French Blood Establishment (EFS) saw their temperature and defrost thresholds pushed to extreme levels. EFS was not compromised directly. Its refrigeration supplier was. Settings for chambers that normally hold around −30°C were reportedly raised toward 110°C. An on-call technician noticed the rise during the night, the products were moved to other facilities, and no blood was lost. EFS supplies around 1,900 healthcare facilities across France. ANSSI’s director general, Vincent Strubel, had warned in October that medical storage could become a target. Authorities have not established that the EFS incident and the supermarket attacks are linked.
The public health risk sits less in the dramatic cases than in the subtle ones. A freezer at 50°C announces itself; nobody sells that stock. A controller nudged a few degrees for a few hours, with its logs adjusted to match, could put unsafe food on shelves or degrade vaccines, insulin and plasma without anyone noticing. The same controllers and the same remote-access habits sit in pharmacies, hospital labs and cold-chain warehouses.
What saved the EFS plasma was a person watching the alarms. Human oversight on the loop, backed by monitoring that worked, made the difference between a near miss and a shortage.
Intelligence that reaches the freezer
This campaign shows threat intelligence sharing working and falling short at the same time. Deception firm Lupovis observed authentication attempts against Danfoss controllers from 20 October, almost two weeks before the second wave. Censys gave defenders a measurable picture of exposure. On 5 November the FBI, CISA, HHS, USDA and DOT published a joint advisory on attacks against refrigeration controllers. Yet when The Hacker News checked Danfoss’s security advisories page on 3 November, it still listed nothing about the attacks.
The gap is distribution. Intelligence circulates well between SOCs, CERTs and vendors. It reaches the refrigeration contractor servicing forty independent stores, or the butcher in an Athens suburb, far less reliably. NIS2 already counts food production, processing and distribution among its critical sectors, but the small contractor holding the remote login will rarely sit in an information-sharing group. National authorities contacting exposed operators one by one is slow and unglamorous work. It is also the part that reached the people who needed it.
Does a freezer need the internet?
Remote access has genuine value. Contractors cover dozens of stores, a 3 a.m. alarm can be handled without sending a van, and energy optimisation needs data. What has no defensible value is a login page reachable from anywhere on the planet, guarded by firmware nobody has updated in years.
The harder question is whether we are prepared to absorb this risk, and most operators never had the chance to decide. You cannot accept a risk you do not know you own. Many store managers learned their controllers were online on the morning the stock spoiled.
Moving forward starts with an inventory of what is connected, who connected it, and who holds the credentials. Management interfaces belong behind a VPN with MFA, never on a public IP. Maintenance contracts should spell out who patches, who monitors and who gets the call at night. End-of-life controllers need replacing, a capital decision boards should make deliberately rather than by default. Temperature monitoring should run independently of the controller, so a compromised controller cannot hide its own tampering. Critical cold storage also deserves a physical safeguard, a mechanical high-temperature cutout that no web interface can override.
Trust remains essential. But it has to be designed, not assumed.
Nobody has claimed either wave, and CERT-FR believes the campaign may still be running. Somewhere tonight, a controller patched in October hums away behind a VPN, and three towns over another still shows its login page to the world. The difference between them is an email someone did or did not answer.
Anastasios Arampatzis is a cybersecurity content strategist, writer, and consultant with expertise in cybersecurity, digital identity, and regulatory compliance. Tassos has a strong background in creating thought leadership content, marketing materials, and strategic communications tailored to CISOs, security professionals, and business leaders. He has contributed to various cybersecurity publications and collaborates with organizations to develop compelling, insightful content that addresses industry challenges. He is a privacy advocate and a member of the ISC2 Hellenic Chapter. Before joining Bora, Tassos was an Hellenic Air Force Officer with a solid background on IT and Infosec.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.