The OT You Forgot You Owned: Hundreds of French Supermarkets Lose Refrigeration

On Sunday night and into Monday morning, attackers remotely hijacked refrigeration control systems at French supermarkets and raised temperatures by triggering the controllers’ built-in automatic defrost function. Staff arrived to find thawed and spoiled stock. French outlets report 250 to 350 affected stores, with victims including Intermarché, Super U and Coopérative U, Carrefour Market, Monoprix, and Leclerc. Losses are reported in the tens to hundreds of thousands of euros per affected business. The Paris prosecutor’s office has opened an investigation, linking the attack to food losses and reports of an outbreak of fires.

The affected systems run older versions of control software from the Danish manufacturer Danfoss. How the attackers got in has not been confirmed.

This Was an OT Attack, Not an IT Breach

Nothing was encrypted. No data was stolen. No ransom note appeared. The attackers did not need any of that, because they were not in the IT estate at all. They were in operational technology: the control systems that make physical processes happen.

A refrigeration controller is an industrial control system in the same sense as a pump controller or a production line PLC. It reads sensors, holds setpoints, and actuates equipment. The attackers did not break it. They used it exactly as designed, triggering a defrost cycle that the controller offers as a standard function. From the system’s point of view, nothing abnormal occurred.

That is the defining characteristic of OT attacks and the reason IT security controls do not catch them. There is no malware to detect, no anomalous process to flag, no exfiltration to spot. The malicious action is a legitimate command issued by someone who should not be able to issue it.

The consequence is also different in kind. An IT compromise costs an organisation its data and its productivity, and there is usually a path back through backups. An OT compromise costs it physical product, physical equipment, and in this case reportedly started fires. There is no decryption key for thawed stock.

Why OT Is Reachable in the First Place

What is confirmed in this case is the exposure. On Monday, security researcher Baptiste Robert found 2,752 Danfoss systems reachable directly from the open internet, 1,590 of them in France. Shodan was tracking over 4,500 reachable Danfoss devices.

This is the normal condition of OT, not an outlier. CISA warned in May 2025 of an authentication bypass flaw in the Danfoss AK-SM 8xxA series, and in August 2025 of a command injection flaw in the same hardware platform. Claroty’s Team82, which found both, demonstrated remote code execution on publicly accessible management interfaces. Fixed firmware exists. Whether those specific flaws were used here is not confirmed, but the pattern they describe is: control systems directly reachable, running firmware that is years behind.

Three structural reasons explain how OT ends up in this state, and they apply equally to a supermarket chain, a manufacturer, a logistics operator, and a property portfolio.

OT is procured and maintained outside IT. A refrigeration contractor, a building automation integrator, or a machine supplier installs the equipment and connects it for remote servicing. The connection is reasonable and necessary. It is also never reviewed by anyone whose job is security, because it is not on anyone’s network diagram.

OT is absent from the asset inventory. Vulnerability scanning covers what the organisation knows it owns, and control systems are rarely on that list. An advisory can be published, acknowledged by the vendor, and fixed in firmware without ever reaching the person responsible for the device.

OT availability outranks OT patching. These systems run continuously and are updated when something fails, not on a cycle. A controller that has worked for six years is treated as working, and the firmware question only arises when it stops.

Detection Was the Difference

Some stores salvaged their stock. The reason is worth noting precisely: managers received alerts about the temperature changes, or the systems were hit close to opening hours and somebody noticed.

That is OT monitoring, even if nobody called it that. The gap between a contained incident and a total loss was whether a change in process state reached a human who could act on it.

Most organisations have this backwards. They have 24/7 alerting on servers that can tolerate an hour of downtime and no alerting at all on physical processes that cannot tolerate twenty minutes.

Where To Begin

Start with OT visibility, because nothing else is possible without it. Build an inventory of every control system in your environment: refrigeration, HVAC, access control, energy management, production equipment, lifts, alarm panels. For each, record who installed it, who maintains it, how it is reached, and what firmware it runs. In most organisations this is a one-off exercise that has never been done, and it reliably surfaces systems nobody knew were connected.

Then determine what is reachable from outside. Ask every maintenance provider which systems they access remotely and by what route, then verify it independently against your external address ranges rather than taking the answer at face value. Services such as Shodan show you what an attacker sees.

Segment what you find. OT should not be directly reachable from the internet, and it should not sit flat alongside office IT. Remote maintenance belongs behind authenticated, time limited, logged access into a segmented zone that cannot reach the rest of the estate, not on a public interface with a vendor password.

Assign firmware ownership contractually. In most maintenance agreements, nobody is explicitly responsible for acting on a security advisory, which is how a controller runs software with a documented authentication bypass eighteen months after publication. Name the responsible party and a response time for critical advisories in writing.

Finally, monitor process state, not just infrastructure. Temperature, pressure, runtime, and setpoint changes should generate alerts that reach somebody who can act, around the clock, through a channel independent of the affected system. An alarm on a screen in a back office is read the next morning, which in this incident was already too late.

Key message: This was an attack on operational technology, carried out entirely through legitimate controller functions, which is why conventional IT security would not have seen it. Thousands of comparable control systems remain directly reachable from the internet. OT is business-critical infrastructure that sits outside most security programmes because an external contractor installed it and nobody inventoried it. Build the OT asset inventory, establish what is externally reachable, segment remote maintenance behind authenticated access, assign firmware responsibility contractually, and alert on process state so that somebody notices while the damage can still be contained.