The attack on French grocery chains ran through refrigeration controllers left reachable from the internet so contractors could look after them. Most plants grant outside vendors the same kind of door, and few keep a full record of who walks through it.
Industrial cyber risk is usually pictured as a sophisticated intruder working through a plant's network to the controller at its heart. The attack that hit French grocery chains this month skipped all of that. The controllers were already on the internet, put there so the contractors who maintain the equipment could reach them from outside. The same arrangement, an outside party with a standing route into a control system, is how most plants keep their own lines running, and the evidence suggests few of them could say with confidence who used that route last week.
During the night of Sunday, October 11, attackers changed settings on refrigeration systems across France. Reuters reported that fridges were forced up to 50°C overnight, and that Les Mousquetaires, owner of Intermarché, said its stores' fridges were heated to that level for six hours. Carrefour said 80 supermarkets were hit, while the vast majority of its 6,000 stores were not. The Paris prosecutor's office described the attack as large-scale and said it was affecting connected refrigerators in several major food retailers across France.
The damage was not limited to spoiled stock. Al Jazeera, citing AFP, reported fires at several stores, and Monoprix said about 5% of its roughly 490 shops were affected. Intermarché chief executive Thierry Cotillard told BFM TV the losses ran to "tens of millions of euros nationwide in a single day." Felix Aime of the security firm Sekoia told Reuters that Spain, Portugal, Poland, Germany and Belgium were also affected.
The targeted equipment was refrigeration management systems from Danfoss, which let store operators and their contractors monitor and adjust temperatures remotely. Danfoss said it was aware of incidents "affecting a limited number of refrigeration management systems" and that the affected units "were running outdated firmware." The weakness was not unknown: the industrial security firm Claroty had published research on August 9 describing Danfoss vulnerabilities that could let an attacker bypass authentication.
The French national cyber agency's CERT-FR alert, first issued on October 12, confirmed numerous compromises of Danfoss AK-SM and AK-SC controllers and added Copeland and Dixell xweb supervisors the following day. Its verdict on the root cause is blunt: exposing a management interface to the internet goes against good practice. Its first instruction is to remove that exposure, and to restore access only through a secure VPN or a protected network.
Two details in the alert matter for any plant. The first is that the access existed for a commercial reason. CERT-FR tells operators to check their insurance contract conditions before cutting the data uploads that go to their refrigeration contractor, and it accepts filtering the contractor's source IP addresses at a firewall only as an emergency measure that should not be considered lasting. The second is that old equipment cannot be cleaned up. An end-of-life device without security fixes left exposed to the internet carries a very high probability of compromise, the alert says, and a factory reset removes the attacker's foothold but leaves the device vulnerable to the same attack again.
Swap the supermarket for a plant and nothing in that description changes. Chillers, compressors, packaging lines, robots and process skids routinely arrive with a service connection so the equipment maker or integrator can troubleshoot without a site visit. Those connections often outlive the warranty, the contract and the person who set them up.
Survey data on how manufacturers govern that access is thin, and the best recent figures come from a remote access vendor with an interest in the answer, so they are worth reading with that in mind. Secomea's State of Industrial Remote Access 2026, a survey of 400 OT, IT, compliance and executive leaders in manufacturing and critical infrastructure published in March, found that only 43% of organisations keep full audit trails of vendor sessions. Where IT and OT alignment is weak, it reported, vendor-related incident exposure nearly triples, and organisations managing between 21 and 100 external vendors report the highest exposure of all.
The North American breakdown, released in July, shows the scale of the problem. 57% of organisations manage six or more external vendors with remote access into OT environments. Only 46% report full auditability of those vendor sessions, and just 23% review vendor credentials monthly or more frequently. That leaves most sites unable to say, at any given moment, which outside accounts can still reach a controller and whether each one is still needed.
The supermarket attack shows what that blind spot costs when the attacker does not need to be clever. Nothing in the reporting suggests a novel technique. The controllers were findable, some were past the end of their support life, and the routes into them had been left open for legitimate maintenance. A plant with the same profile does not need to be targeted specifically. It only needs to be on the same list when someone scans for the same interface.
The French retailers did not lose their stock to an attack on their own networks. They lost it through a convenience built for the people who service their equipment. Most plants run on the same convenience, and the time to close it is before someone else goes looking for it.
Guide
The French controllers were compromised because their management interfaces sat open on the internet. This guide sets out the security architecture that keeps supervisory and control systems reachable for the people who need them without leaving them exposed to everyone.
Download
Guide
A remote connection left open for a refrigeration contractor is exactly the kind of exposure that sits outside most contractor reviews. This guide shows how to surface those overlooked risks before they turn into an incident.
Download
Report
Most vendor connections into a plant exist so equipment makers can service what they sold. This report on where aftermarket service is heading explains why that remote service model is growing, and why plants should set the terms on which it connects.
Download
