French Supermarket Refrigeration Attacks Highlight Widespread Exposure of OT Controls

Attackers remotely manipulated refrigeration controls at French supermarkets overnight on 11–12 October, reportedly raising temperatures to as much as 50°C and causing food spoilage, equipment damage and reported fires. Reports differ on the scale: one cited at least 350 stores, including Carrefour, Intermarché, Monoprix and Coopérative U locations, while another reported more than 700 affected supermarkets. ANSSI’s preliminary assessment pointed to internet-exposed management systems with weak passwords and inadequate administrative protections, apparently without exploitation of previously disclosed software vulnerabilities; the initial access method remains unconfirmed. ANSSI and the Paris prosecutor’s cybercrime unit are investigating, and the attackers’ identities and motives remain unknown.

Forescout’s Vedere Labs identified 12,976 internet-exposed refrigeration service observations across 6,017 public IP addresses in 99 countries and territories, illustrating the broader opportunity for temperature and defrost manipulation. Eighty percent of observed Danfoss StoreView services ran older firmware potentially affected by known vulnerabilities; separately, two authenticated vulnerabilities affect Danfoss AK-SM 8xxA versions before 4.3.1. Researchers tracked more than 20 claimed refrigeration attacks since January, with pro-Russian groups Z-Pentest Alliance and NoName057(16) among the most active, but did not establish their involvement in the French incident. Recommended safeguards include removing direct internet exposure, securing remote access with individual contractor accounts and multifactor authentication, patching systems, monitoring configuration changes, and clearly assigning security responsibilities across facilities, contractors and IT. Hospitals and other cold-chain operators face potential risks, although no hospital refrigeration attacks were confirmed in the research.