Overnight on October 11 and 12, refrigerators and freezers in hundreds of French supermarkets began to warm up. By morning, display cases had reached around 50 °C, stores were throwing out their fresh and frozen stock, and the Paris prosecutor’s office was investigating what it called a “large-scale cyber-attack,” according to BleepingComputer. Reported victims include Intermarché, Coopérative U, Carrefour, Monoprix, and E.Leclerc, and AP reports that prosecutors are also examining reported fires.
None of the targeted systems were laptops, servers, or anything in a typical MSP’s asset list. They were refrigeration controllers. That’s the lesson worth carrying back to every client environment you manage.
What we know, and what we don’t
France’s national cyber response center, CERT-FR, says it is aware of “numerous compromises” of remote refrigeration controllers. Its alert originally named the Danfoss AK-SM and AK-SC series, and an October 13 update added Copeland xweb and Dixell xweb. Le Monde reported a smaller second wave against Dixell-equipped stores the following night, with settings changed so rapidly that a refrigeration specialist believed the attack was automated.
Danfoss told AFP that most of the affected equipment was legacy product that “no longer receive[s] software or security updates,” naming the AK-SM800 and AK-SC355, with one AK-SM800 version running outdated firmware.
What hasn’t been confirmed is how the attackers got in. Researchers had already disclosed flaws in these platforms. CISA’s 2025 advisory covered an authentication bypass and a command injection flaw in the Danfoss AK-SM 8xxA series, and Claroty’s Team82 counted 2,765 internet-exposed AK-SM 800A devices in its research. But as of October 13, The Register reports, authorities had not identified the entry point or confirmed that those known flaws were used. Claroty itself says details on access aren’t yet available. Any client conversation should hold that line.
Why this is an MSP story
Two details make this relevant well beyond grocery retail.
The systems weren’t run by the stores. Le Monde notes that supermarkets generally don’t manage the IT behind their refrigeration. Specialist contractors supply and maintain it. Cybersecurity Dive reports that the attack on about 300 Intermarché and Netto stores reportedly targeted a service provider that manages the stores’ refrigeration equipment. That provider hasn’t been named.
The insurance question came up immediately. CERT-FR’s guidance tells operators to check their insurance contract terms before cutting off the internet data feed to their refrigeration provider. A roundup of French press coverage reports that Intermarché said some store policies might not cover this type of incident.
Your clients have the same shape of risk, even if they don’t sell groceries. Restaurants, medical offices, labs, warehouses, and manufacturers all run refrigeration. Nearly every office has HVAC controls, badge readers, cameras, or a building management system. Many of those devices sit on the client’s network or internet connection, are maintained by an outside contractor, and appear on nobody’s asset list.
The playbook: bring building systems into the program
1. Find them
Ask each client and their facilities contacts which building systems are network-connected: refrigeration and cold storage, HVAC and building management, access control, cameras, and anything else a contractor maintains remotely. Then check from the outside. An external scan of the client’s public IP addresses will show whether a management interface answers from the internet.
2. Take them off the public internet
CERT-FR’s first instruction is direct: remove internet exposure from affected units and from any unit exposed on a public IP address, and check the configuration, especially defrost schedules. It adds that “exposing a management interface to the Internet is contrary to good practice.” CISA’s guidance matches: keep control systems off the internet, behind firewalls, and isolated from business networks.
3. Give contractors a controlled path in
Contractors still need access. CERT-FR recommends restoring it only through a secure VPN or protected network, and says filtering to the provider’s source IP addresses is an emergency measure, not a permanent fix. Treat this like any other third-party remote access: a named contact, an approved method, and a record of who connects. It’s the same discipline as the remote-access inventories we covered for RMM tools.
4. Name an owner and a lifecycle date
For each device, record the client owner, the contractor, the firmware version, and whether the vendor still supports it. CERT-FR is blunt about end-of-life equipment: a factory reset removes an attacker’s persistence, but an unpatchable device left online “will certainly be compromised again.” Unsupported systems belong on a replacement plan or fully isolated.
5. Verify that alarms tell the truth
Cybersecurity Dive notes that Claroty researchers demonstrated an attacker could shut off cooling while staff believed temperatures were normal. Where the stakes are high, such as food, medication, or lab samples, an independent temperature sensor or alert path is worth discussing.
6. Put it in the risk register and the insurance file
Log each building system as an asset with a risk entry, an owner, and a review date. Then confirm with the client and their broker how the policy treats operational technology and contractor-managed systems. As we’ve written before, coverage increasingly depends on controls that match what was represented to the carrier.
Where Blacksmith InfoSec fits
Building systems rarely fail because no one cared. They fail because no one was named. In Blacksmith InfoSec, contractor-managed systems can sit in the client’s risk register alongside their policies, vendor records, and evidence, with tasks for exposure checks and lifecycle reviews. That turns “who owns the freezer?” into a question with a documented answer.
The client conversation
Keep it simple: attackers recently took over refrigeration systems at hundreds of stores in France. We want to make sure every connected system in your building, including the ones your contractors manage, is on our list, off the public internet, and reached only through an approved path. That’s a security program conversation any business owner can follow.
Frequently asked questions
Q: What happened in the French supermarket refrigeration attack?
A: Overnight on October 11 and 12, 2026, attackers took remote control of refrigeration controllers at hundreds of French supermarkets and raised temperatures to around 50 °C, forcing stores to discard food (BleepingComputer). CERT-FR reported numerous compromises of Danfoss AK-SM and AK-SC controllers and later added Copeland xweb and Dixell xweb (CERT-FR).
Q: How did the attackers access the refrigeration systems?
A: That hasn’t been confirmed. Researchers had previously disclosed vulnerabilities in some of the affected platforms, and Danfoss said many affected units were end-of-life or running outdated firmware (AFP). As of October 13, authorities had not identified the entry point (The Register).
Q: Why should MSPs care about building systems like refrigeration and HVAC?
A: These systems often share a client’s network or internet connection, are maintained remotely by outside contractors, and are missing from IT asset inventories. A compromise can cause physical losses, operational disruption, and insurance questions, even when no computer is touched.
Q: What should organizations do if they have internet-exposed refrigeration controllers?
A: CERT-FR recommends removing internet exposure, checking configurations such as defrost schedules, restoring access only through a secure VPN or protected network, applying the manufacturer’s firmware and hardening guidance, and factory-resetting compromised units. It warns that end-of-life equipment left online is likely to be compromised again (CERT-FR).
Q: Could insurance be affected by an attack on building systems?
A: It can be. CERT-FR advises checking insurance contract terms before cutting off a refrigeration provider’s internet data feed, and Intermarché reportedly said some store policies might not cover this type of incident (press roundup). Clients should confirm with their broker how their policy treats operational technology and contractor-managed systems.