French Supermarket Fridges Hit 50C and Suddenly Everyone Cares About OT

Hackers pointed remote refrigeration controllers at “defrost forever,” French freezers climbed toward 50C, ice cream aisles reported mid-20s Celsius, food hit the dumpster by the pallet, and a few sites got small fires for dessert. CERT-FR alerted on Danfoss AK-SM / AK-SC plus Copeland xweb and Dixell xweb controllers exposed to the internet. European officials started saying “food security” out loud. The security industry will now sell you a fridge zero-trust webinar. The actual fix was “stop putting EOL cold-chain controllers on public IPs,” which somehow required spoiled inventory to become interesting.

BBC reporting (Ian Aikman and Hugh Schofield) and parallel AP/CNN coverage describe a multi-chain incident across France: Coopérative U (100+ stores), Intermarché/Netto (about 180 affected, another ~100 preemptively yanked offline), Carrefour (80 of ~6,000), Monoprix (~5% of 400+), plus E.Leclerc mentions. Nationwide guesses sit around roughly 400 stores out of ~15,000. Two Alsace stores alone reported about €270,000 in losses. Paris prosecutors opened a large-scale cybercrime investigation. No public attribution circus yet. Just melted logistics.

What CERT-FR actually said

Alert CERTFR-2026-ALE-012 (first version October 12, updated October 13, 2026) names the remote management gear in scope:

• Danfoss series AK-SC
• Danfoss series AK-SM
• Copeland xweb
• Dixell xweb

The summary is not subtle: numerous compromises of remote refrigeration controllers. Exposing management interfaces to the internet is contrary to good practice. Solutions split into “not yet owned” and “owned.”

If not compromised: remove public internet exposure (check insurance contracts before you cut the frigoriste’s telemetry), verify defrost schedules, bring access back only via VPN or a protected network, apply vendor hardening (Danfoss examples: firmware updates, Strict security mode, change default passwords).

If compromised: pull internet exposure, factory reset, rebuild config, then the same VPN/hardening path. CERT-FR’s warning in bold: attack campaigns are probably ongoing, and putting EOL gear back on the internet after a reset is how you get re-owned before the ice cream refreezes.

Vendor reality check

BBC quotes Danfoss saying affected cold units were older models whose security software could not be updated against a risk the company had identified, and that it had “long advised” customers to keep supported systems current. That sentence is doing Olympic-level liability yoga. “We told you the EOL gear was sad” is not the same as “the food supply was designed as if attackers exist.”

Intermarché’s public detail, via Reuters as relayed by BBC, said fridges heated to 50C for about six hours overnight into Monday, with all affected food discarded. Managers walked into branches greeted by hot air from freezers. Some locations reported small fires. BFMTV published an ice cream aisle display reading 26.5C. That is not a ransomware PDF on a shared drive. That is thermodynamics as an attack path.

The politics layer (where the hypocrisy lives)

European Food Commissioner Christophe Hansen condemned the hack and wrote that food security needs more attention because “the weaponisation of food has become a reality.” Coopérative U CEO Dominique Schelcher called the targeting of equipment essential to the French food supply “unacceptable” and asked for investigation. Correct emotions. Late timing.

For years, OT and cold-chain remote access sat in the “facilities problem” bucket while CISOs argued about browser isolation budgets. Insurers quietly knew internet-exposed BMS and refrigeration controllers were a clown car. CERT-FR had to publish the obvious: public management interfaces on industrial controllers are a bad idea. The policy conversation only got oxygen when grocery chains lost millions of euros of stock and someone photographed a warm freezer.

Also note the insurance footgun CERT-FR flagged: cutting internet telemetry to the refrigeration contractor may collide with contractual monitoring requirements. That is the state of play. Security and the service contract disagree, and the freezer does not care who wins the meeting.

What this means outside France

1. Inventory cold-chain and BMS remote access the way you inventory VPN concentrators. If you cannot name the vendor, model, firmware, and exposure, you are volunteering.
2. Assume EOL controllers with public IPs are already in someone’s mass scan. CERT-FR said campaigns are likely ongoing.
3. VPN or private network only for frigoriste access. IP allow lists to the vendor are an emergency brake, not an architecture.
4. Defrost schedule integrity monitoring. A six-hour forced heat cycle should page someone before the night crew smells it.
5. Tabletop the food-safety response with legal and ops: discard rules, public messaging, insurer notice, prosecutor cooperation. Cyber IR that stops at “we reset the PLC” is incomplete when the incident is also a health event.

What “good” looks like after the dumpsters are emptied

• No refrigeration or building controllers with inbound internet; outbound vendor access through brokered, logged sessions
• Supported firmware or device replacement plan with dates, not vibes
• Default passwords gone, Strict modes on, MFA on any human gateway
• Alerting on defrost duration, setpoint drift, and unexpected remote command sessions
• Contract language that does not punish you for isolating a compromised telemetry path during an incident

Sloth take

We secured the email. We secured the laptop. We left the machine that keeps the nation’s protein cold on a public IP with an aging firmware story and a vendor note that said “we warned you.” Attackers did not need a nation-state novel exploit chain. They needed our refusal to treat grocery thermodynamics as cyber. Patch what can be patched. Rip what cannot. And maybe stop discovering OT exposure via the smell of thawed inventory.

OT-aware assessments without the webinar filler: Dark Edge Consulting.

Cold chain as critical infrastructure (without the buzzword costume)

Food retail refrigeration is not a lifestyle IoT curiosity. It is a distributed control system with health, insurance, and national resilience consequences. France’s incident made that visible because the failure mode was cinematic: warm freezers, discarded stock, political statements. Quieter failure modes (partial setpoint tampering, intermittent defrost abuse, selective store targeting) may not trend on BBC and still wreck a regional operator.

If your country ran a similar playbook against pharmacies, blood banks, or vaccine cold storage, the powerpoint would write itself. Grocery got there first in public.

Attack surface patterns to inventory this week

• Remote refrigeration controllers with HTTPS/HTTP on public IPs
• Cellular modems and vendor “cloud bridges” that bypass the store firewall in the name of convenience
• Shared default credentials across dozens of sites because the contractor’s van has a laminated password card
• EOL hardware that cannot take a secure firmware and therefore cannot be “temporarily” exposed
• Monitoring contracts that require constant telemetry and conflict with incident isolation

What boards will ask (and weak answers)

Weak: “We have a firewall.” Better: “No cold-chain controller accepts inbound internet; vendor access is brokered, logged, and MFA’d; EOL units have replacement dates.”

Weak: “Danfoss said they warned customers.” Better: “Here is our supported/unsupported controller census and the capital plan for the unsupported pile.”

Weak: “It was only France.” Better: “Here is our exposure scan dated today.”

Regulatory and prosecutorial backdrop

Paris prosecutors labeling this a large-scale cyberattack matters for evidence handling. Stores that factory-reset before imaging may please ops and injure investigations. Coordinate with counsel. CERT-FR’s dual path (compromised vs not) is operationally useful: isolation first, then rebuild, then controlled reconnection. Copy that structure into your IR runbook even if you never sell baguettes.

Sources

• CERT-FR CERTFR-2026-ALE-012 (Oct 12-13, 2026)
• BBC News, “Fridges in French supermarkets hit by cyber attack”
• CNN / AP reporting on the French supermarket refrigeration incident (Oct 2026)
• Public statements from Coopérative U, Mousquetaires / Intermarché, Carrefour, Monoprix, Danfoss as quoted in BBC