On the night of October 11 through the morning of October 12th, 2026, attackers remotely took over refrigeration at several hundred French supermarkets.
The stores belonged to Intermarché, Coopérative U, E.Leclerc, Carrefour, Monoprix, and several other chains, and the attackers hacked in and used the system controls to put coolers and freezers into a defrost cycle that ran continuously at 50°C (122°F).
By the time staff arrived in the morning, the food had to be thrown out, and aisles were closed, with losses estimated in the tens of millions of euros.
Nothing reported so far points to a phished employee or a cracked laptop. Infosecurity Magazine reported that the attackers went after outdated versions of Danfoss’s freezing and refrigeration control software running on consoles that could be controlled remotely without a secure channel, and the Paris prosecutor’s office has opened an investigation.
Equipment Built to Be Reached From Anywhere
Remote access is why these controllers exist in the first place, and it is also why the refrigeration controller cyberattack succeeded. They are designed so a technician outside the building can check temperatures, change settings, or clear an alarm, saving someone a drive to the store in the middle of the night.
But anyone who finds that remote door can use it too. The affected controllers ran old software with no secure channel guarding that access, so the door was effectively unlocked. And there were a lot of doors. The day after the attack, one researcher found 2,752 of these systems exposed online, including 1,590 in France.
The Fixes Never Came, or Never Got Installed
Danfoss says most of the controllers that were hit were older models it stopped supporting years ago, one in 2016 and another in 2021, so no update was ever coming for them. Some newer units were hit too, still running outdated software even though Danfoss had released fixes for remote-access flaws in that model in 2025, flaws researchers at Claroty Team82 later published in detail. Investigators haven’t said which weakness the attackers actually used.
That’s the pattern other businesses should watch for. In most cases, the update isn’t skipped because someone was careless. As long as a cooler keeps food cold, it never prompts a support ticket, and nobody has a reason to go near it, so reliable equipment tends to go unpatched.
Earlier this year, the same research team found a similar problem in building HVAC controls. On the Trane Tracer SC+, a diagnostic login meant only for Trane’s own technicians used a scheme that could be calculated without knowing the secret.
Take a Slow Walk Through Your Own Building
If your business keeps anything cold, whether it’s a restaurant, a grocery, a food production line, or a clinic storing medication, there is probably a walk-in cooler or freezer at the back of the building with its control panel mounted on the wall nearby. Start by checking whether that panel connects to your network through a cable or over Wi-Fi. Many newer units do, because getting an alert on your phone when the temperature drifts is genuinely useful. If yours is connected, do you know when its software was last updated?
After that, look at the building’s heating and cooling. Most mid-sized buildings run their HVAC through a controller the service company’s technician can reach remotely, which is exactly the kind of access the Trane finding was about. In plain English, the manufacturer had created a login for its own staff, and anyone who worked out the math behind it could guess the credentials.
There is usually more to find. Security cameras often record to a DVR kept in a back closet, and it is probably still running the software it shipped with. The door badge system relies on a small computer of its own, tucked away somewhere in the building, and even the copier, the label printer, and the warehouse scale are on the network and communicating with something.
Then there’s the vendor who “logs in remotely to check on it.” Ask them exactly how they get in. Ask who else could use that same door, and whether the password has changed since the install (or since the technician who set it up left the company).
Nobody Counts What Doesn’t Look Like a Computer
Because none of these things feel like computers, they rarely get counted, updated, or watched the way computers do. Laptops typically receive patches on a regular schedule, while the DVR in the closet has probably gone untouched since it was first mounted on the wall.
All of it still runs around the clock, and in most small offices it shares a network with accounting. That’s how a supermarket freezer turned into a business problem instead of a maintenance call.
Five Things to Check Before Next Quarter
None of this requires an IT background to start. It mostly requires someone willing to ask vendors a few direct questions.
- Make a list of everything plugged into your network, not just the computers.
- Ask each equipment vendor how they connect remotely and when the software was last updated.
- Keep this equipment off the open internet and separated from the computers that run the business.
- Replace equipment the manufacturer no longer supports, even if it still works fine.
- Know who is watching your network overnight on a Sunday, because that’s when the French attack happened.
If the honest answer to the last one is “nobody,” start there.
Where Cycrest’s Monitoring Fits, and Where It Stops
Cycrest’s managed detection and response (MDR) runs on every computer and server and integrates with the firewall, network switches, and Microsoft 365.
It doesn’t run on your walk-in cooler, the HVAC controller, or the camera DVR. Those devices can’t run it. However, it doesn’t need to to protect your computer network.
However, Cycrest’s MDR still protects the servers and computers that are sharing that same network infrastructure which can save your company from a catastrophic loss. If someone gets in through a forgotten device, an non-updated legacy product on the network, and starts moving toward the machines that matter, analysts watching around the clock can cut off the affected machine before the problem spreads.
Afterward, the logs help trace where the hack started, so you know which device needs attention.
Cyber insurance carriers increasingly require this kind of monitoring. Cycrest provides it at cost, because protection that’s too expensive to keep doesn’t protect anyone.
Start With the Devices Nobody Has Looked at in Years
Most Spokane businesses have a few devices on this list that nobody has looked at in years. That’s normal, and it’s fixable.
Cycrest can walk the building with you and tell you plainly what’s connected, what’s outdated, and what’s exposed. The fixes are usually ordinary: a software update, a password change, a device moved to its own network, or retiring something the manufacturer stopped supporting.
We’re glad to take a look at the cooler panel, the closet DVR, or the vendor who logs in remotely. Contact Cycrest, and we’ll find a time to go through it with you, and there’s no obligation to do anything afterward.
