What happened on Sunday night
Shoppers in France woke on Monday morning to a surreal scene: frozen-food aisles roped off, doors of display freezers hanging open, and in some stores the smell of scorching electrical equipment. Overnight on Sunday 11 October, intruders broke into internet-connected refrigeration controllers in hundreds of supermarkets and pushed fridge and freezer temperatures as high as 50°C — hotter than a sauna, and more than enough to ruin everything inside.
The damage was immediate and staggering. Food worth millions of euros spoiled in hours. In some stores the extreme heat started fires or melted equipment outright. More than 500 shops were hit across France, with the country’s biggest grocery chains all affected: Intermarché/Netto at over 300 stores, Cooperative U at more than 100, Carrefour at around 80, Monoprix at roughly 30, plus several E. Leclerc outlets. And the attack was not confined to France — similar incidents were reported in Spain, Portugal, Poland, Germany and Belgium, raising the prospect of a continent-wide campaign.
The weakest link: how attackers got in
The controllers at the heart of the attack were made by Danfoss, the Danish industrial firm whose refrigeration management units run in supermarkets across Europe. Most of the affected devices were legacy models — the AK-SM800 and AK-SC355 generations — running outdated firmware on a platform the manufacturer considers discontinued. Danfoss says it had previously urged customers to update; France’s cybersecurity agency, ANSSI, subsequently told operators to disconnect the units from the internet or severely restrict access to them.
But stale firmware was only part of the failure. Security experts say many of the devices were reachable directly from the public internet, with no virtual private network in front of them and no restricted list of IP addresses permitted to log in. Worse still, a significant number were apparently still using credentials close to factory defaults: the username “admin” and a password set to the current date. As security researcher Kevin Beaumont put it, that is “the opposite of security.”
In practical terms, the attackers needed neither sophistication nor expensive tooling. Basic cyber hygiene — the dull, unglamorous checklist of taking industrial equipment off the public internet, placing remote access behind a VPN with an IP allowlist, retiring default credentials and keeping firmware current — would very likely have shut them out entirely. The stores, or in some cases their refrigeration contractors, simply never did it.
Why it matters
This was not a smash-and-grab on a database or a ransomware shakedown. Nobody is even sure what the attackers wanted. The intruders have said nothing and demanded nothing, which leaves two main theories on the table: vandalism on an industrial scale, or a deliberate disruption operation possibly linked to a nation-state actor. Either way, the episode is a vivid demonstration of how vulnerable the physical systems underpinning daily life have become as they are wired up to the internet.
Consider what refrigeration does in a modern food supply chain. It is not a convenience; it is load-bearing infrastructure. A coordinated attack that simultaneously disables cold storage across hundreds of stores in multiple countries is not just an IT incident — it is a food-safety event, an insurance event, and potentially a public-order one. Two stores in Alsace alone reported losses of €270,000. Intermarché estimated the nationwide toll in the tens of millions of euros in a single day, before food-disposal and fire-repair costs are even counted. Overall losses could plausibly reach into the hundreds of millions of euros.
The story also punctures a comforting assumption: that attacks on operational technology — the hardware and software that physically runs factories, plants and utilities — require elite, state-grade tradecraft. Here, the barrier to entry appears to have been about as high as logging into a router with the password printed on its sticker. That ease is what should genuinely alarm anyone responsible for connected infrastructure.
A warning that went unheeded
This catastrophe was, in a grim sense, foreseeable. Researchers at the security firm Claroty warned about precisely this class of exposure — internet-facing industrial controllers with weak credentials and unpatched firmware — last October. In February this year, the US Cybersecurity and Infrastructure Security Agency issued a similar advisory urging operators of industrial control systems to lock down remote access. The French supermarket attack now reads like a case study written in advance.
It is also part of a long and undistinguished history of smart-appliance and industrial-system failures. In 2013, attackers breached the US retailer Target through its heating and ventilation contractor, ultimately exposing tens of millions of payment cards. In 2016, the Mirai botnet hijacked hundreds of thousands of poorly secured cameras and home routers with default logins to knock major websites offline. In 2019, the Norwegian aluminium giant Norsk Hydro was crippled by ransomware spreading through operational networks. And in 2021, the meat processor JBS paid a multimillion-dollar ransom after attackers shut down plants across three countries. In every one of those episodes, the underlying theme is the same: operational technology bolted onto the internet without the security practices that IT teams take for granted.
Researchers at Pen Test Partners summed up the prescription this week in blunt terms: take controllers off the public internet, gate remote access behind a VPN and an IP allowlist, bring third-party equipment onto the network in a controlled, documented way instead of leaving it on a contractor’s own connection, change known and default credentials, and patch to a current release. None of this is exotic. All of it is neglected.
