> When defrost becomes sabotage: 3 OT lessons from France’s supermarket attack

On the night of 11 October, someone remotely put the cold cases of several hundred French supermarkets into defrost. At Intermarché and Netto stores, fridges and freezers warmed to around 50°C and stayed there for about six hours, according to Les Mousquetaires, which expects losses in the tens of millions of euros. By morning, staff were filling skips with meat, frozen goods and vegetables. Coopérative U counted 80 affected stores out of roughly 2,000. Its chief executive, Dominique Schelcher, told RTL that the cold chain held in most of them. Only a minority reacted too slowly and lost stock, and he credited store staff and refrigeration contractors for the difference. Intermarché said its affected stores had to throw away everything. A second wave followed in the night of 12 to 13 October, this time also reaching stores with Dixell controllers. Similar controllers, similar night, very different mornings. That gap is the part of this story an operator can act on. CSO has already reported which systems were hit and what CERT-FR wants done with them. Nobody has claimed responsibility and no ransom demand has surfaced, which Reuters reports has puzzled investigators; whoever did this wanted spoiled food, not money, or has not said what they wanted yet. Neither CERT-FR nor Danfoss has said how the attackers got in: exposed management interfaces, known flaws and stolen contractor credentials are all still on the table. The three lessons that follow do not depend on either answer. Your refrigeration contractor is your perimeter Schelcher made a remark that deserves more attention than the temperature figures: Coopérative U stores do not buy from Danfoss. They buy from refrigeration contractors, who supply the controller, configure it and keep remote access to it so they can adjust setpoints without driving to the store. E.Leclerc told AFP that the attack reached its stores through one of its refrigeration equipment suppliers. The controller’s embedded web server exists for exactly this purpose, and the contractor’s performance guarantees usually depend on the data feed it provides. Danfoss has seen this before. Its own technical newsletter from October 2025 records attacks on the AK-SM 800 in 2022: 16 Russian supermarkets and 40 Israeli stores. All 40 Israeli sites, the newsletter notes, lacked proper firewall or VPN protection. Four years later the same model, end-of-life since May 2021, was still on the internet in France. The pattern is familiar from industrial sites. The party who decides whether a controller is exposed is not the party who eats the loss when it is. The contractor wants a browser and a public IP address because it turns a Sunday-night callout into a two-minute job. The store carries the inventory. A standard maintenance contract rarely makes that trade-off visible to the person signing it. How deep the dependency runs shows in a sentence I have not seen in a national advisory before. CERT-FR’s alert, updated on 16 October, tells operators to check their insurance terms before cutting the internet link to the refrigeration contractor. The data feed is contractual, and depending on the agreement, cutting it can touch monitoring obligations or policy conditions. And the insurance side is bleak anyway: brokers and underwriters told Reuters that cyber policies typically exclude physical loss, so the spoiled stock is unlikely to be covered. Intermarché told AFP its insurance does not cover the incident. So, the first question: who can log into your refrigeration controllers today, and over what path? Store network, contractor VPN, a cellular router the contractor installed years ago, a port forward on the store router? If answering requires calling the contractor, you do not control that perimeter. You rent it. The lesson is a contract clause, not a firewall rule. The maintenance agreement should name every remote path into the equipment and forbid any other; require access through your gateway or VPN with accounts tied to named technicians; give you the logs; oblige the contractor to tell you when a controller leaves vendor support or a vulnerability is published; and let you revoke access without losing the cold chain. Cold-case controllers run for decades. The contract that pays for their maintenance rarely says any of this. After France, it should. Defrost is a feature. Treat the command as the event Whatever got the attackers in, the damage itself came from ordinary refrigeration functions. Defrost is a built-in cycle on every refrigeration controller, and in the second wave the setpoints were reportedly pushed to values no case can reach. Many controllers also offer a setting that suppresses temperature alarms during defrost and for a delay afterwards, so that scheduled cycles do not page anyone at 3 a.m. That is a sensible configuration. It is also exactly what makes a forced defrost quiet. Whether it played a role in France has not been established, and Coopérative U’s experience shows that alarms did reach people in most of its stores. The structure is the same as in the Minnesota water attacks in July: intended functionality, used by the wrong person at the wrong time. A temperature alarm is a process control. It tells you the product is getting warm. It cannot tell you that the command which made it warm came from someone who should not have been logged in. The signal worth alarming on is an unexpected mode or setpoint change outside a maintenance window, and it gets louder when several circuits move at once or several stores that share a contractor move in the same hour. CERT-FR’s updated alert now tells operators to review their defrost schedules specifically. That is the right instinct: look at the configuration, not just the thermometer. Not every controller can export that event, least of all the models that were hit. Where it cannot, an independent temperature logger that does not depend on the controller catches the consequence early. Either way, someone has to receive the alert, understand it and have the authority to act. At 3 a.m. that chain runs from a store employee to an external technician to a central operations desk, and if nobody has written down who calls whom, the minutes go to finding out. In the second wave, a refrigeration technician in the Gironde told Le Monde that his teams reached a store near Bordeaux in time, and nothing had to be thrown away. Schelcher’s minority lost their stock because they could not respond fast enough. One factor clearly separated the two groups: time from first actionable warning to intervention. The lesson, concretely: an alert on any remote setpoint or mode change that no technician has announced, weighted by time of day and by how many circuits move together, raised by the controller where it can and by the contractor’s monitoring platform where it cannot, since the contractor is the only party that sees all its stores at once. A temperature logger that does not share the controller’s network, as the second opinion. A written call chain for 3 a.m. with names, not roles. And a drill: have the contractor change a setpoint on a test circuit at night and measure how many minutes pass before someone with authority has it reversed. That number is the one to report to the board. An unsupported controller is a budget line, not a patch ticket Claroty’s Team82 published three flaws in the current model, the AK-SM 800A, in August, all fixed in firmware 4.3.1 or earlier, and counted 2,765 of its management interfaces reachable from the internet. Nobody has linked those flaws to the attack. Danfoss says most affected units were the older AK-SM 800 and AK-SC 355, with some 800A units on outdated firmware. For the older models, there is nothing to patch. Danfoss ended updates for the AK-SM 800 in May 2021 and for the AK-SC 355 in 2016. CERT-FR therefore does not lead with patching. It tells operators to take every AK-SM, AK-SC and XWEB controller off the public internet, restore access only through a VPN or protected network, and for compromised Danfoss units, restart, or failing that, factory-reset, and reconfigure before returning them to service. It adds a warning that reads like a prediction: a reset alone removes persistence but leaves the device just as vulnerable, and the campaign is probably still running. The sequence is the one I argued for when CISA asked operators to harden Siemens S7 PLCs: exposure first, firmware second, replacement third. In practice, that means a list of every refrigeration controller by model, firmware and vendor support status by the end of this week; a management interface on a public IP address taken off it the same day; current firmware on everything the vendor still supports; and for everything it does not, a replacement date with a budget line and a name next to it. An aging controller may still do its job perfectly well, and replacing it costs money, engineering time and downtime, so without an owner the decision slides. The security team can document the risk. Someone on the commercial side has to accept it or fund the replacement, and after Reuters’ insurance round-up, that person should know they are also accepting the stock. Which brings the story back to the two groups of stores. Nobody has shown that firmware or hardware explains which stores kept their stock. What is documented is that a warning reached someone who could act before the cold chain gave way. That is an operational capability, and it can be tested long before an attacker tests it for you. Sekoia told Reuters that Spain, Portugal, Poland, Germany and Belgium saw cases too, and the same controller families run cold storage in warehouses and pharmaceutical distribution, maintained by the same kind of contractor. So, before the week is out, do two things. Search Shodan or Censys for your own refrigeration management interfaces, because someone else already has. Then call the contractor and ask one question: when you log into our sites, how do you get there? If the answer is a public IP address and a password, with nothing in between, you have found your incident. It just hasn’t happened yet.