Twice this fall, when we’ve written about attacks on the systems that run physical equipment, we’ve reached for the same example to make the point land for a small business: the walk-in cooler. If the office network can reach the refrigeration controls, we said, then a bad click at the front desk can become a problem in the back of the house.

Overnight on Sunday, that stopped being a hypothetical.

Attackers got into the refrigeration control systems at hundreds of French supermarkets and switched on the defrost function — then left it running. Chilled cases and freezers that should have been holding food near or below freezing climbed to as high as 50 degrees C, about 122 degrees F, for roughly six hours. By morning, stores were hauling meat, dairy, frozen goods, and produce to the dumpster. No data was stolen. Nobody demanded a ransom. The damage was simply physical, immediate, and expensive.

This is the seventh chapter in our series on attacks against physical systems — after water utilities in Minnesota and Colorado, exposed industrial controllers, a power plant, and two oil tankers — and it may be the one that maps most directly onto the businesses on your own street.

What’s confirmed

• The timing. The attack happened overnight from Sunday, October 11, into Monday, October 12.
• The equipment. The affected systems were refrigeration management controllers made by the Danish manufacturer Danfoss, which supermarkets use to monitor and control cooling equipment remotely.
• The method, at a high level. The defrost function, which normally runs for a limited time each day, was forced to run continuously, driving temperatures up to about 50 degrees C for around six hours.
• The victims. Intermarche’s parent company told Reuters that around 150 of its stores were affected, and Cooperative U confirmed it was hit as well. Reports have named other chains too, but the counts vary between outlets and haven’t all been confirmed.
• The equipment’s condition. Danfoss told Reuters the affected units were running outdated firmware, and has said it has long advised customers to keep supported systems updated and migrate legacy systems to current ones.
• The response. The Paris prosecutor’s office has opened an investigation, and France’s national cybersecurity agency says it is mobilized at both the national and European level.

A few corrections to what’s circulating on social media. You may have seen posts saying “fires broke out.” According to AFP, the prosecutor’s inquiry includes reports of fires starting at some installations — that’s being investigated, and details haven’t been made public, so we’d treat it as unconfirmed rather than as a wave of store fires. We also don’t yet know how the attackers got in: whether through equipment exposed to the internet, stolen credentials, an unpatched flaw, or another route. Nobody has claimed the attack, and investigators haven’t named anyone. We’ll stick to what’s established.

They didn’t break the equipment. They used it.

Here’s the detail that should change how you think about connected equipment. Nothing in these stores was destroyed by malware in the traditional sense. The attackers took a perfectly normal, built-in feature — the defrost cycle every commercial refrigeration system uses to keep coils from icing over — and simply refused to let it stop.

That’s the same pattern we’ve seen in every chapter of this series. In Colorado, attackers changed pumping cycles and switched off alarms. In Poland, they put industrial controllers into stop mode. Here, they turned on defrost. In each case the equipment did exactly what it was told. The weapon was the equipment’s own legitimate functions, in the hands of somebody who shouldn’t have had the controls.

The lesson for any business with connected equipment: you don’t need to imagine an exotic attack to see the risk. Just look at what your equipment’s controls can do, and ask what happens if someone else is holding them. A refrigeration controller can turn on defrost. A thermostat can turn off heat. A building system can unlock a door. A camera recorder can delete footage. If those controls are reachable by the wrong person, the harm requires no special skill — only access.

Lesson one: the fix already existed

This is the part that will sting for the businesses involved. In August, security researchers published findings about weaknesses in Danfoss refrigeration controllers, including a hidden authentication mechanism that could be abused to tamper with them. According to reporting, a fix has been available since mid-September. And Danfoss says the units that were hit were legacy controllers running outdated firmware — some of them models that no longer receive updates at all.

We don’t yet know whether those specific flaws were the way in. But the pattern is familiar: a weakness is published, a fix is released, and a large population of equipment sits unpatched because nobody owns the job of updating a refrigeration controller. It’s not on anyone’s list. It’s not a computer, in most people’s minds. It’s the thing in the back that keeps the milk cold.

We’ve written before about how researchers found thousands of industrial controllers sitting openly on the internet, and how attackers in Colorado went after utilities serving fewer than 200 people simply because their equipment answered. Equipment that’s too old to receive updates is a replacement decision, not a maintenance decision — and the longer it stays in service, the longer it stays a known door.

Lesson two: who actually manages your equipment?

Buried in the coverage is a detail every business owner should sit with. Intermarche’s parent company told Bloomberg that the refrigeration systems were under Danfoss’s management, and that responsibility for filing a complaint with authorities would fall to the supplier. France’s retail federation called on Danfoss and the refrigeration contractors who service these systems to be fully transparent.

In other words, the stores didn’t run these systems themselves. Someone else did. That’s normal — almost no grocery store employs its own refrigeration engineers — and it’s exactly the arrangement we wrote about with the power plant in Poland, where attackers came in through a connection the plant didn’t control. When equipment is installed, monitored, and maintained by an outside company, its security depends on that company’s practices: how it connects remotely, how it protects its logins, how quickly it applies updates.

The question for your business isn’t just “is my equipment secure?” It’s “who can reach my equipment, how, and what are they doing to keep it current?” If the honest answer is “the service company handles that,” it’s worth one phone call to find out what “handles” actually means.

Lesson three: Sunday night, and nobody was there

The attack ran overnight from a Sunday into a Monday, and the temperatures stayed high for about six hours. That timing isn’t a coincidence. It’s when the fewest people are watching.

Commercial refrigeration normally comes with temperature alarms, and we don’t know yet whether they fired in these stores, who received them, or whether anyone could act on them in the middle of the night. But the question applies everywhere. In our Colorado post, the detail that stood out was that attackers disabled the alarms before changing anything else. If your temperature alerts are generated by the same system an attacker controls, and they go to an inbox nobody checks after closing, they won’t save you at 2 a.m. on a Monday.

The practical fix is old-fashioned and cheap: an independent alert that goes to a phone someone actually answers overnight, and a simple standalone thermometer or temperature logger that doesn’t depend on the network at all. When the smart system is lying to you, a dumb thermometer doesn’t.

Lesson four: the damage was physical, and immediate

Most cyber incidents we write about involve data: stolen records, leaked identities, encrypted files. This one didn’t touch data at all. It went straight to inventory. French reporting has put potential losses in the tens of millions of euros, between destroyed stock, the work of checking and restoring equipment, and empty shelves while stores restock.

That raises a question many owners have never asked: if a cyberattack destroys physical goods, does your insurance cover it? Spoilage coverage, equipment breakdown coverage, and cyber coverage are often separate policies with different exclusions, and an attack that causes spoilage can fall into the gaps between them. We’re not insurance advisors, and the answer depends entirely on your policies — but it’s worth a conversation with your agent before you need to file a claim, not after.

This isn’t just a supermarket problem

If your business keeps anything cold, this story is about you. Restaurants and their walk-ins. Convenience stores and grocers. Florists. Breweries and food producers. Pharmacies. Medical, dental, and veterinary practices with medication and vaccine refrigerators. Labs. And it extends past refrigeration to any connected equipment that does something physical: HVAC, building controls, door access, irrigation, production machinery. If it can be adjusted from an app or a web page, somebody other than you might be able to adjust it too.

What to do this week

1. List your connected equipment. Refrigeration, HVAC, building controls, anything with a remote-monitoring app or web page. You can’t protect what you haven’t counted.
2. Call whoever services it. Ask three questions: Is this equipment on current firmware? Can it be reached from the internet, and does it need to be? How do your technicians connect to it remotely, and how are those logins protected?
3. Retire equipment that no longer gets updates. If the manufacturer has stopped supporting a controller, it will never be fixed. Plan its replacement.
4. Make sure an alarm reaches a human overnight. Independent of the system it’s watching, sent to a phone that gets answered.
5. Keep a dumb backup. A standalone thermometer or logger in every critical cooler costs very little and can’t be hacked from across the country.
6. Keep equipment off your office network and ask your insurance agent how a cyber-caused loss of inventory would be handled.

Worth asking about your own business: Do you know which of your equipment can be controlled remotely, and by whom? * When was its firmware last updated — and is it still supported? * If the temperature in your cooler climbed at 2 a.m. on a Sunday, who would know, and how? * And if a cyberattack spoiled your inventory, would your insurance pay for it?

The takeaway

Hundreds of supermarkets lost their fresh and frozen stock overnight because someone gained control of equipment most people don’t think of as a computer, and used one of its ordinary features against it. The fix for the flaws researchers had published was already available. The equipment was managed by an outside company. And it happened on a Sunday night, when nobody was there to notice.

None of that is unique to France or to supermarkets. Our environment review looks for exactly these blind spots: the connected equipment nobody counts as IT, the vendor connections that reach it, the firmware nobody has updated, and the alerts that wouldn’t reach anyone at 2 a.m. The walk-in cooler was always the example we used to make the risk feel real. This week, a few hundred stores found out it was never just an example.

Sources: AFP (via Boursorama and Techniques de l’Ingenieur); Reuters (via Dexerto); Bloomberg (via Quartz); Cybernews; Hackread; Cyber Security News, October 12, 2026. Store counts reflect the companies’ own statements where available; reports naming additional chains have not all been confirmed. The method of initial access has not been disclosed, no group has claimed responsibility, and no attribution has been made. Reports of fires at some installations are part of the Paris prosecutor’s inquiry and have not been detailed publicly.