Few countries rival France for the cultural importance of their cuisine. As a result, it’s surreal that on the night of 11 October 2026, refrigerators in hundreds of French supermarkets were remotely told to defrost themselves. By morning some were over 100°F, and some caught fire.
Three weeks later it happened to more than 100 stores across Belgium, the Netherlands, Sweden, Ireland, Estonia and beyond. In public remarks, victim Intermarché projected losses in the tens of millions of euros.
It would be easy to file this as a unique kind of retail problem, but that’s not true. This event is instructive to any organization that depends on internetworked physical equipment.
Old controllers, new connections
In the French case, the attackers didn’t need to develop a zero-day to get in. Danfoss, whose controllers were compromised, said most of the units “were older models that it no longer updates.” The two relevant units lost security update support in 2016 and 2021, respectively. No patches have shipped in five years or more.
In the second wave, the opening was insufficient cybersecurity hygiene. Danfoss reported that the Dutch systems “were not on a secure network and still used default passwords.” Ouch.
For an idea of the scale of this type of exposure, Forescout Technologies Inc.‘s Vedere Labs found 12,976 internet-facing refrigeration management services in 99 countries, and of 4,697 exposed Danfoss StoreView services, 80% were running firmware older than the patches that would address two published CVEs. France’s national CERT, recognizing the broader risk, warned that an end-of-life device left online is very likely to be compromised, and that a factory reset will not save it.
These controllers were built to manage compressors, not to resist attacks from the Internet. Unfortunately, the convenience of remote maintenance caused them to be connected, but nobody tested to see if they were safe.
Are fridges in scope?
Penetration tests and red team engagements exercise and abuse the IT estate, probing domains, endpoints, cloud, applications, and even people. In my experience, refrigeration controllers, HVAC, building management and access systems aren’t viewed as critical. They’re under the authority of the facilities teams or contractors, and they aren’t common targets on the IT asset inventory. Their interconnectivity and configuration are less well-known, and the policies for their protection are a physical/operational activity, not a cybersecurity priority.
This distinction has been wrong for years. In November of 2009, I wrote about a contract security guard named Jesse William McGraw. McGraw inserted a malware-enabled USB into the computer that ran heating and air conditioning for a surgery center in a Dallas medical building. His resulting control of the system caused federal prosecutors to assert that “he could have affected the treatment and recovery of patients” and “the efficacy of all temperature-sensitive drugs and supplies.” He was sentenced to 110 months in federal prison. Different country, different fridge, but a similar risk.
What once took an insider (in a cliché hoodie) now takes an internet search.
As of this week, it’s clear that healthcare is still in the line of fire. Overnight, between November 1st and 2nd, attackers reportedly changed setpoints from about −30°C to 110°C on freezers holding samples and plasma for France’s blood service, EFS, according to Cyber Security News. An on-call technician noted rising temperatures and teams responded to the event.
The French Health Ministry reported no operational consequences because the issues were detected and corrected. In the US, as reported in late October, the Pentagon is treating similar freezer failures at six US military commissaries as suspected hacks.
Four steps to begin credible Adversary Simulation
Attackers don’t respect the line between IT (Information Technology) and OT (Operational Technology), and more of these critical systems have become the objectives behind the attacks. To provide confidence and value, offensive testing must cross that line as easily. Here are four steps to get there.
- Prioritize for disruptive results, not asset inventories. When creating plans or RFPs, involve those outside of IT to war-game the disruptions that would hurt the business most. It may be spoiled stock, an unsafe ward, a halted manufacturing line. Define the outcome you must prevent, then task authorized experts with finding a path to reach it.
- Map the aging estate. Inventory every controller on every internetworked system to find out-of-support firmware and software, default credentials and remote-access paths.
- Capitalize on OSINT. Attackers found vulnerable, outdated controllers on the public internet. Your process or your partner should show you these first. It’s not hard.
- Collaborate with facility teams and contractors. The people who install and support the equipment will know what’s connected. They’re a valuable partner and their access has to be understood and locked down.
Remember that operational technology supports real-world, physical systems and processes. Live systems can fail under pressure, so clearly define the schedules and safety limits for testing in collaboration with the operators.
The risk isn’t only in IT
Those markets didn’t lose millions because of a firewall misconfiguration or a stolen ID. They lost them when the refrigerators stopped refrigerating.
Organizations have their own critical systems that need to keep working: an air conditioner, a boiler, a door controller, or maybe a simple pump, installed years ago and connected without inspection since.
If an attacker comes looking for your oldest connected system tomorrow, would your current testing have found it first?
