When Cyberattacks Turn Up the Heat: Lessons from the French Supermarket Fridge Incident

Written by Angie Chan | Technically Reviewed by Donny Chong

‍

‍The remote exploitation of unpatched supermarket refrigeration controllers shows how outdated firmware, exposed management interfaces, and delayed patching can produce immediate physical disruption—forcing operators to take systems offline simply to regain control.‍

‍

Overnight on 11–12 October 2026, hundreds of French supermarkets discovered that refrigeration units had been forced into continuous high-temperature defrost cycles. Temperatures climbed as high as 50 °C. Fresh and frozen stock spoiled. In some stores, small fires were reported. Losses are estimated in the tens of millions of euros, with individual locations discarding hundreds of thousands of euros in inventory.

‍

Major chains—including Intermarché/Netto, Coopérative U, Carrefour, Monoprix, and E.Leclerc—were affected. Roughly 300–400 stores across France reported impact. Paris prosecutors opened a cybercrime investigation, and France’s national cybersecurity agency (ANSSI/CERT-FR) is coordinating with European partners. Authorities later confirmed that controllers from Danfoss (primarily AK-SM and AK-SC series running outdated firmware), as well as Copeland and Dixell XWEB systems, were involved. Many of these devices exposed web-based remote management interfaces directly to the internet.

‍

This was not a network flood. It was a targeted intrusion against internet-exposed operational technology (OT) management software and firmware. Attackers issued malicious commands through reachable application interfaces. To stop the unauthorized heating, many operators had to take the refrigeration management systems offline entirely—exposing a clear failure in application vulnerability management, interface exposure control, and patch governance.

‍

Application exposure is the new battlefield

Unpatched application software and neglected firmware updates create direct paths for attackers who want to seize control of operational assets. The French incident demonstrates that internet-facing management interfaces on legacy OT controllers function as high-value application targets. Once reachable, authentication weaknesses, outdated software, or missing security controls allow command injection that produces real-world physical effects.

‍

The attackers did not need complex tools beyond exploiting exposed remote management interfaces and unpatched firmware. Once systems were taken offline for containment, business continuity collapsed because of gaps in application lifecycle management and the absence of protective controls in front of those web interfaces.

‍

Key lessons for network operators and critical infrastructure owners

1. Legacy OT software and unpatched vulnerabilities create systemic exposure
   Many of the affected controllers ran legacy software and outdated firmware that no longer received regular security updates. Remote management interfaces that were never hardened remained reachable. Proactive vulnerability scanning, strict access controls, and application-layer protections help reduce the chance that these interfaces become open doors. CERT-FR specifically advised operators to disconnect internet-exposed controllers, apply firmware updates, enforce strict security levels, and avoid default credentials.
   ‍
2. Office IoT and smart building systems are often unmonitored entry points
   Unmanaged devices—from smart-building HVAC controllers and badge readers to IP cameras, printers, and smart TVs—are frequently left unpatched with default credentials and exposed interfaces. The same pattern of poorly maintained, internet-facing edge devices appears across environments and frequently becomes a foothold or lateral-movement path into operational systems.
   ‍
3. Segmentation and monitoring remain non-negotiable
   Once an attacker reaches a management interface, the blast radius can be large. Strict network segmentation—placing smart-building hardware, office IoT, and OT traffic on dedicated VLANs—limits what a compromised device can reach. Continuous traffic-behaviour baselines and anomaly detection help teams distinguish legitimate activity from attack traffic in real time and identify unusual command patterns directed at operational controls.
   ‍
4. Continuous application security and patch governance close exposure windows
   Relying on manual or periodic patching cycles for distributed OT software leaves dangerous exposure windows. Organizations must enforce strict patch management schedules, apply virtual patching at the web application firewall (WAF) layer where management interfaces are web-based, and maintain rigorous vulnerability governance to block targeted exploits before physical disruptions occur. Virtual patching can close exposure windows quickly while permanent firmware fixes are rolled out across distributed locations. We recently demonstrated this approach in our response to Recent NGINX Vulnerabilities: What Customers Need to Know About NGINX Rift and Related Issues, where Nexusguard’s WAF delivered virtual patching to block known exploit patterns while customers remediated the underlying configurations.
   ‍
5. Unify IT/OT governance and build specialized response playbooks
   Operational technology and smart-building systems can no longer sit outside IT security processes. Joint risk assessments, centralized asset inventories, and shared access management give critical control systems the same visibility and privileged-access controls as enterprise IT. Teams need practiced incident-response playbooks for refrigeration, HVAC, and building controls that define manual fallback procedures, out-of-band communication, safe containment steps, and recovery paths that avoid thermal events or stock loss.
   ‍
6. Maintain continuous visibility of field hardware
   Legacy firmware, exposed management interfaces, and unpatched edge controllers are persistent risk. Automated or passive asset discovery that maps connected devices and tracks firmware versions across locations, combined with regular testing and vendor patch routines, helps ensure high-risk endpoints are identified and shielded before exploitation.

What this means for CSPs and the organisations they serve

Communications service providers and enterprise security teams sit at the centre of the challenge. As critical infrastructure increasingly relies on web interfaces, remote management platforms, and connected software, protecting the application layer that fronts these systems becomes essential.

‍

Nexusguard’s Application Protection service provides integrated WAF capabilities that help block known web-based exploits, authentication bypass attempts, and other application-layer attacks against internet-facing applications, APIs, and management interfaces. Combined with 24/7 SOC monitoring and continuous visibility, this supports detection of anomalous access to management interfaces and helps organizations shrink the window of exposure created by unpatched systems. Virtual patching at the WAF layer allows rapid mitigation of known vulnerabilities while permanent firmware updates are deployed. The same application-layer controls that protect traditional web assets extend naturally to OT and smart-building management interfaces that rely on HTTP/S.

‍

Looking ahead

The French supermarket attack is a wake-up call. As more operational technology is connected for efficiency and remote management, the attack surface expands. Attackers will continue to look for ways to turn digital compromise of application interfaces into physical disruption—whether through temperature control, process automation, or other techniques that force operators to take systems offline.

‍

Organizations that treat application vulnerability management, interface exposure control, and WAF protections as foundational requirements will be better positioned. That means enforcing timely patch cycles, isolating sensitive management interfaces, applying application-layer protections (including virtual patching) where web interfaces exist, and maintaining clear governance across IT and OT.

‍

At Nexusguard, Application Protection delivers the layered WAF and application security controls needed to safeguard the internet-facing management software and interfaces that keep modern infrastructure running. Strong vulnerability management, patch discipline, and continuous application-layer defense are essential foundations of operational resilience.

‍

Frequently Asked Questions

What happened during the French supermarket refrigeration attack?
Overnight on 11–12 October 2026, attackers compromised refrigeration management software (primarily linked to legacy Danfoss controllers running outdated firmware, with additional impact on Copeland and Dixell systems) at hundreds of French supermarkets. They forced systems into continuous high-temperature defrost cycles reaching up to 50 °C, spoiling food inventory and causing substantial financial losses.

‍

Why did operators have to take systems offline?
Once attackers gained the ability to issue management commands through exposed interfaces, the practical way to stop the unauthorized heating was to isolate or take the refrigeration control systems offline. This highlighted the consequences of unpatched, internet-exposed management software.

‍

How can organizations protect OT and smart-building infrastructure?
Prioritize patching and firmware updates for legacy equipment, enforce strict network segmentation (dedicated VLANs), maintain continuous visibility and anomaly detection, and apply application-layer protections such as WAF capabilities (including virtual patching) for any web-based management interfaces.

‍

How does Nexusguard help organizations address exposed management software and unpatched vulnerabilities?
Nexusguard’s Application Protection service includes integrated WAF capabilities that help block known web-based exploits, support virtual patching for internet-facing applications and APIs, and enable detection of anomalous access to management interfaces. Together with continuous monitoring and our 24/7 SOC, this helps organizations reduce exposure windows created by unpatched systems and protect the application layer that fronts operational controls.

‍