Hundreds of Supermarket Freezers Were Defrosted Overnight. The Way In Belonged to a Maintenance Contractor.

On the night of October 11, attackers set the fridges and freezers at hundreds of European supermarkets to defrost. They got in through a controller managed remotely by a maintenance contractor, the kind of device most IT departments have never inventoried.

The payload in this attack was warm air. On the night of October 11, someone took remote control of the refrigeration controllers at hundreds of French supermarkets and told the fridges and freezers to defrost. Staff arrived in the morning to thawed stock and, in some stores, equipment that had started to catch fire.

No customer records were stolen. No ransom note appeared on a screen. The losses were food, trading hours and the trust of shoppers who expect the cold aisle to be cold.

The device that made it possible was not a server, a laptop or a firewall. It was a box in the back of the store that a refrigeration contractor manages remotely under a maintenance agreement. Most IT departments would not list it as theirs. Almost every mid-market business has one.

What Happened

According to The Hacker News, attackers reached the stores through the controller that runs all of a site’s refrigeration, a unit made by the Danish manufacturer Danfoss that maintenance firms can administer from a distance. Les Mousquetaires, which owns the Intermarché chain, said its units were put into defrost and heated to as much as 50°C.

France’s CERT-FR, the national government’s incident response team and part of the cybersecurity agency ANSSI, published an alert on October 12 saying it knew of numerous compromises of the Danfoss AK-SM and AK-SC series. By October 13th, the alert also listed Copeland xweb and Dixell xweb units among affected systems. Its first instruction was blunt: take the controllers off the internet, or filter access to them. Putting a management interface on the open internet, the alert notes, runs against good practice.

The scale was wide rather than deep. Carrefour reported around 80 supermarkets affected and Monoprix, about 30. Coopérative U reported 80 of its 2,000 stores, and its chief executive Dominique Schelcher said the cold chain held in most of them, with only a minority losing goods. Intermarché’s affected stores, by contrast, threw out the products concerned. Thierry Cotillard, who heads Les Mousquetaires, told BFMTV he expected losses in the tens of millions of euros across France. Retailers in Belgium, Germany, the Netherlands, Poland, Portugal and Spain were hit too, SecurityWeek reported, which also noted that in some equipment the temperature climbed for six hours before anyone noticed.

Two details deserve more attention than they have had. First, Danfoss said most of the units involved were older products that IT no longer updates, naming the AK-SM 800, end of life since May 2021, and the AK-SC 355, phased out in 2016. Some current-model AK-SM 800A units were hit as well, running outdated firmware. Second, Schelcher pointed out that Coopérative U’s stores are not Danfoss customers at all. They buy from refrigeration contractors who supply and maintain the system.

As of October 13 neither French authorities nor the manufacturer had said how the attackers got in, and CERT-FR had published no indicators of compromise. Security firm Claroty had disclosed flaws in the newer AK-SM 800A in August and reported finding thousands of its management interfaces reachable from the internet, but no one has established a link between that research and this attack. Treat anyone who tells you otherwise with suspicion.

Why This Matters for Businesses

You do not run a supermarket, so here is the translation. Somewhere in your organization is a piece of equipment that a service provider can reach from the outside, under a contract signed by facilities, operations or whoever owns the building. HVAC. Building access and door controllers. Cold storage. CCTV. A production line. A generator. The vendor needed remote access to do the job, the vendor got remote access, and nobody wrote it down anywhere IT would look.

That access is a security control. It has simply been delegated to someone else’s help desk, with whatever password policy and session logging that help desk happens to use. It deserves the same scrutiny as a domain admin account, because in operational terms it can do more damage, much faster.

The second lesson is harder. For a lot of this equipment, patching is not on the menu. When the manufacturer declared the product end of life five years ago, there is no update coming, and CERT-FR’s advice to disconnect or filter reflects that reality rather than an abundance of caution. The alert goes further and warns that a factory reset on an unpatchable device removes the attacker’s foothold while leaving the door open for the next one. Isolation is the control. Plan for it now rather than discovering it during an incident.

One more wrinkle, and it is a good one. CERT-FR tells operators to check their insurance terms before cutting the data feed to the refrigeration contractor. Continuous remote monitoring may be a condition of cover. Pulling the cable to be safe can quietly make you less covered, which is the kind of detail that only surfaces when someone reads the policy.

What Organizations Should Consider

The good news is that this is a cheap problem relative to the damage. The remedy is mostly inventory and segmentation, not a new product. These questions are worth putting to your IT team and your facilities lead in the same meeting, since neither can answer them alone.

  • Which devices on our network can a third party reach from outside the building, and who signed the agreement that allows it?
  • Does that access arrive through a managed VPN or a single controlled entry point, or is a port open to the internet? CERT-FR treats source IP filtering as an emergency measure, not a permanent one.
  • Is vendor access time-bound, individually attributed and logged? If we asked for it to be revoked by close of business, could anyone actually do it?
  • Which of these devices are past end of support, and what does replacement cost against the value of what they protect?
  • If we isolate the device, what stops working? Does the equipment keep running locally, and does the alert still reach a human?
  • Who gets woken up when a temperature, a door or a pressure reading goes out of range at two in the morning? Six hours of unnoticed heat is a monitoring failure, not just an access failure.
  • Has anyone verified the configuration itself lately, including scheduled routines like defrost cycles? Settings can be changed as quietly as credentials.

If your asset inventory and your third-party access register are two different documents, they should be consolidated into one. If neither exists, start with the register. It is shorter, and it is where the surprises live.

How ISM Can Help

This is ordinary work done properly. Our Managed IT Services team builds and maintains the asset inventory that includes the equipment nobody claims, and keeps the network segmented so a controller in the back of a building cannot be reached from the internet or used as a path to anything else.

Cybersecurity & Risk Management covers the harder conversation: which third parties hold standing access, what that access can reach, and what the plan is for equipment that will never be patched again. Identity & Access Management applies the same rules to vendor accounts as to your own, so contractor sessions are authenticated, limited in time and logged where you can see them.

Our packaged tiers, Insight SecureStart, Insight Managed Defense and Insight Cyber Command, scale that coverage to the size of the estate. You can see the full range on our services page.

Talk With Our Team

If you do not know how many outside parties can reach equipment inside your buildings tonight, that is the conversation to have, and it is a shorter one than you would expect. Get in touch and we will walk your estate with you, contractor agreements included, and tell you plainly which connections need a boundary around them.

Prefer to take a look on your own first? The Cyber Maturity Calculator is a reasonable place to gauge how your controls stand up before anyone picks up the phone.

Sources