CYBERATTACK ON THE FRIDGES?

13 hours ago

17 min

C

During the night between Sunday 11 and Monday 12 October 2026, in around 150 Intermarché stores across France, the refrigerated cabinets stopped cooling and started heating, reaching 50 degrees Celsius for six hours, as the Les Mousquetaires group, which owns Intermarché, told Reuters (good grief, I remember kettles looking different!); the next morning the store managers found meat, cheese and yoghurt fit only for the bin, and the same scene was repeated, according to the chains, in 80 Carrefour stores, in about 5% of Monoprix stores and in a still unknown number of Coopérative U and Leclerc stores (the totals swing between 250 and 500 shops depending on who is counting, which is why I always give you each figure with the name of whoever counted it…). Thierry Cotillard, chairman of Intermarché, interviewed by the broadcaster BFMTV and quoted by Agence France-Presse, spoke of tens of millions of euros of goods lost in a single morning, adding the detail that strikes me as the most telling in the whole affair: insurance does not cover this kind of incident.

It was not ransomware, because nobody asked for money and, as of 14 October 2026, nobody had claimed anything, and it was not a data theft either, which is the shape twenty years of headlines about cyberattacks have taught us to expect. Someone got into the systems that run the refrigeration, mostly controllers made by the Danish manufacturer Danfoss, and ordered the cabinets to go into defrost all at once: in other words, they triggered a perfectly ordinary function, the one that heats the coils to melt the ice, at the wrong moment and for the wrong length of time. Left on for hours instead of the few minutes it is designed for, it heats the whole cabinet. The damage is physical, it is counted in kilos of food and in euros, and it goes through an object no customer has ever looked at in their life: the controller that runs the fridges, hanging on a wall in a back room, with its little green light on.

If you are wondering why I am writing about this here rather than leaving it to a French news magazine, the answer lies in a name and two dates. The name is Dixell, another maker of refrigeration controllers, separate from Danfoss, which was founded in Alpago, in the province of Belluno, in north-eastern Italy, is now called Copeland Controls and is still based there: on 13 October 2026 its xweb supervision systems were added to the list of affected devices updated by the French authorities. The first date is 20 May 2025, the day the American cybersecurity agency published an advisory on vulnerabilities in those same Danfoss controllers, explicitly recommending that they should not be reachable from the Internet. The second is 31 October 2026, the deadline by which Italian companies already on the NIS2 register (NIS2 being the European directive on network security) must have their basic security measures in place. Between the first and the second there are seventeen months in which, judging by the results, part of the industry forgot to disconnect those controllers from the Internet, which in many cases means, quite literally, unplugging a network cable (in others it is much harder, especially if they have a SIM card on board).

What we know, and what we still don’t

The most solid source is the CERT-FR alert, issued by the incident response team of the French cybersecurity agency (ANSSI), published on 12 October 2026, updated the following day and again on 16 October. It reports numerous compromises of remote controllers for refrigeration systems, names the Danfoss AK-SM and AK-SC series and, in the update, the xweb systems by Copeland and Dixell, and above all it contains a sentence that should be framed and hung in every purchasing department: “exposing a management interface on the Internet is contrary to good practice” (you don’t say…). The recommendations are the ones anyone working in security has been repeating for twenty years: take the devices off the Internet, reach them only through a protected private network (the famous VPN), check the defrost schedules, change the factory passwords. And there is a warning that weighs more than all the rest: an end-of-life device, one that no longer receives fixes, left exposed has a “very high” probability of being compromised, and resetting it to factory settings is not enough, because it stays vulnerable and will be breached again.

Danfoss, for its part, told Cooling Post that most of the affected units are legacy products, such as the AK-SM800, declared end-of-life in 2021, and the AK-SC355, phased out in 2016, or current models running outdated firmware. Which merely moves the problem elsewhere: is your system still under maintenance or not? The rest of the picture is still moving, and it is only honest to say so: the Paris prosecutor’s office has opened an investigation with the French police unit for cybercrime; a source close to Prime Minister Sébastien Lecornu told Reuters that ANSSI had reportedly identified a vulnerability in the Danish software, while the public alert names none; an analyst at the firm Sekoia, again speaking to Reuters, claims that Spain, Portugal, Poland, Germany and Belgium were also hit, but for now that is a lone voice (and I treat lone voices the way I treat mushrooms picked by a friend: probably fine, but I’d show them to someone first). No attribution, no claim of responsibility, no ransom demand: who did it and why, at the moment, nobody knows, and I distrust anyone who tells you otherwise with confidence.

Seventeen months of warnings, read by whom?

The part that is not moving, on the other hand, is the timeline, and it is worth setting out in some kind of order… On 20 May 2025 CISA, the US Cybersecurity and Infrastructure Security Agency, published advisory ICSA-25-140-03 on Danfoss AK-SM 8xxA series controllers: the most serious flaw was that the service password was generated from the device’s date and time, so anyone who knows the method can work out the day’s key on their own and bypass the login entirely (for the nerds, a “code of the day” that feels very nineties, with a severity score of 8.2 out of 10). Danfoss fixed the password flaw with release R4.2; on 26 August 2025 the advisory was updated with two more vulnerabilities, one of which allows commands to be executed on the device, and CISA’s recommendation is spelled out plainly: “Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet”, put them behind a firewall and use a VPN for remote access.

On 9 August 2026 the researchers at Claroty Team82, the same people who had reported the problem to CISA, published the full account under a title that today reads like a prophecy, “Freeze the Controller, Defrost the Food”, and put a number in it: 2,765 AK-SM 800A controllers visible on the Internet according to Censys, a search engine that takes a roll call of everything connected to the network. Two and a half weeks later, on 26 and 27 August 2026, in more than half a dozen commissaries on American military bases, from Fort Irwin in California to Naval Station Newport in Rhode Island, the freezers failed on the same night, and at Fort Huachuca, in Arizona, a notice from the base said “ALL freezers went into defrost mode”, as Military Times reported; a defence official told the paper it would be “inappropriate to speculate” about the cause, Army and Air Force investigators opened their own inquiries, reported by Stars and Stripes, and Bruce Schneier, who knows a thing or two about security, asked on his blog whether someone was hacking the Department of Defense’s refrigerators, answering himself “It sure seems like it”, while admitting it was “all speculation at this point”: a clue, in short, not proof.

Let me stop here, because what we need is the version that holds up, not the one that makes the most noise: nobody has shown that the 2025 vulnerabilities were the ones used in France, Danfoss talks about old devices and neglected software, and the American cause has not been confirmed. But the point I care about does not need that proof: that the control panel of an industrial refrigerator should not sit on the Internet, reachable by anyone who cares to look for it, had been written in black and white for seventeen months in a government advisory, repeated by a research firm two months before the attack and illustrated by a suspicious incident in the Pentagon’s own backyard a month and a half earlier. And I am old enough to remember that we were already talking about this in 2017, when I covered the thousands of private cameras left online (in Italian) and set out three theorems of social psychology on the security of connected devices (in Italian). What more was needed, a telegram? A carrier pigeon?

The elastic waistband of the fridge cabinets

The question I keep asking myself, and that you are probably asking too, is how this is possible, and the most honest answer is not stupidity, which explains little and absolves everyone. The sociologist Diane Vaughan spent years studying the decision to launch the Space Shuttle Challenger, which exploded on 28 January 1986, and in The Challenger Launch Decision (1996) she gave the mechanism a name: normalisation of deviance. A group of competent people accepts an anomaly, in her case the erosion of the seals on the solid rocket boosters, because the previous flight with that anomaly went fine, and next time the accepted margin widens a little. When Columbia disintegrated in 2003, the investigation board, with which Vaughan worked, used an image worth keeping in mind: NASA’s rules had become “an elastic waistband, expanding to hold larger deviations from the original design”, until the anomalies “became routine signals, not signals of danger”.

Now put the elastic waistband on the fridge cabinets: the controller is connected to the Internet for a very concrete reason, because the refrigeration technician wants to see the alarms on their phone at three in the morning and change a setting without getting in the car, and every night the fridge works is proof that it’s fine as it is. The CISA advisory is a document in technical English on an American website that no supermarket manager will ever open, the controller has been in the back room for years without causing any trouble, and the remote connection, at some point, stops being a choice and becomes part of the furniture. There is a detail in the French alert that says it better than any theory, and that in my view explains everything: before cutting off the data feed to the supplier, writes CERT-FR, check the terms of your insurance contract. If CERT-FR feels the need to write that, it is because in many cases that data feed is required by the maintenance contract or by the policy itself, and to put it the way a friend would down the pub: the cable the attacker came in through was often put there by the contract (and since I have been doing this job for a while, it makes me laugh, with that slightly bitter laugh you get when the solution to a problem is also its cause).

A perimeter that belonged to nobody

That leaves the second half of the question, namely why nobody unplugged that cable when the warnings were there, and here normalisation alone is not enough, because it explains blindness inside one organisation and not across an entire supply chain. Danfoss sells the controller and says the ones hit are old; the installer fitted it years ago; the maintenance contractor needs remote access to do the job; the chain pays for the fridge and often does not even know the controller talks to the Internet; the insurer, in the end, does not pay out. The German sociologist Ulrich Beck had a name for this too, organised irresponsibility, the subtitle of his 1988 book Gegengifte: complex systems produce harms for which no actor is formally responsible, because everyone followed their own procedures, and the harm has no culprit. In Risk Society (1986) he had added that new kinds of risk escape the logic of insurance, which is exactly what Cotillard said on television, with far fewer citations.

To find a way out of this fog there is a lesson from my own country, and from a much more tragic story. In 2014 the Joint Divisions of the Italian Court of Cassation (the “Sezioni Unite”), in the judgment on the fire at the ThyssenKrupp steelworks in Turin, made clear that when a company is held liable for a crime of negligence, its interest must be looked for in the conduct, that is, in whoever decided to save money: no company wants the accident, but someone cut the measures that would have prevented it, and that saving has a beneficiary. I say this with every caution, because it is my own reading and that case was about workplace safety, whereas here the attack is deliberate and was committed by someone else; but the door left open is still a choice made by whoever runs the installation, and the criterion works perfectly well here too. The useful question is not who triggered the defrost, which the French magistrates will establish, but who saved money: on the end-of-life controller that was never replaced, on the VPN that was never configured, on the hour of a technician’s time it would have taken to change the factory password. Perimeter security, which I consider the bare minimum (and I say that as a hacker, even before I say it as a consultant…), consists first of all in knowing what you have connected to the network, who gets in from outside, under which contract, and keeping off the Internet everything that has no business being there. It is an inventory and an unplugged cable, small stuff, which costs, at a rough guess, less than a morning’s worth of dairy in the bin.

And in Italy, where the NIS2 deadline is at the end of the month

NIS2 is a European directive and each country has transposed it with its own law, so French supermarkets answer to the French version; in Italy it is Legislative Decree 138 of 2024 (in Italian, “decreto legislativo 138/2024”), and read with this case in mind it makes quite an impression. Article 23 says that the management bodies of the entities within its scope approve the security measures, oversee their implementation and are liable for breaches: cyber risk, by law, is a problem for the board of directors and not for the technical department. Article 24 lists among the mandatory measures supply chain security, including relationships with direct suppliers, and requires account to be taken of the specific vulnerabilities of each supplier: a public government advisory on a controller you have in your shop is exactly that, written a year and a half in advance.

Except there is a gap, and it is worth looking at closely. For the food sector, Annex II of the decree covers companies engaged in wholesale distribution and industrial production and processing, while retail as such is not mentioned: a supermarket chain may fall within scope because of its warehouses, its logistics hubs or its processing operations, if it exceeds the size thresholds, but the fridge cabinet in the shop round the corner, where food spends its last hours before going into the trolley, is not something the law looks at explicitly (curious, isn’t it, that the point closest to the people eating is the least watched…). For those who are inside, the calendar is tight: 31 October 2026 is the deadline by which entities entered on the NIS register in 2025 must have operational the basic measures set by the National Cybersecurity Agency (ACN) in its determination 379907 of 2025, as ICT Security Magazine explains, and from that point the Agency can move from supporting entities to checking them.

On the manufacturers’ side, the interesting thing is something else. Since 11 September 2026 the Cyber Resilience Act, the European regulation that treats cybersecurity as a product requirement, has obliged manufacturers to report to the national incident response team and to ENISA, the European cybersecurity agency, within 24 hours, every actively exploited vulnerability in their products, including those sold before (I talked about it when the regulation was still a proposal, at video.matteoflora.com/1139, in Italian). If ANSSI really has found an exploited vulnerability in Danfoss software, the report would fall to Danfoss and it would be one of the first concrete cases of that obligation, and from December 2027 a product with known exploitable vulnerabilities simply cannot be sold any more. As for the people who buy the controllers and keep them switched on, though, none of these rules is needed to unplug a cable: all it takes is one person in the back room and half an hour, and as of 14 October 2026 there were no public advisories from CSIRT Italia, the incident response team of the National Cybersecurity Agency, telling Italian chains to go and check.

On Monday 12 October 2026, in France, supermarket managers filled the bins with yoghurt and cheese. The companies involved sell in Italy too, but how many Italian shops still have a controller like that hanging on the back-room wall, connected to the network, nobody knows for sure, and that is precisely the problem: its little green light, for seventeen months now, has kept saying that everything is fine…

CYBERATTACK ON THE FRIDGES?

What we know, and what we still don’t

Seventeen months of warnings, read by whom?

The elastic waistband of the fridge cabinets

A perimeter that belonged to nobody

And in Italy, where the NIS2 deadline is at the end of the month

Further reading

Theory

Sources

l'autore

Matteo Flora

aggiungi commento

cancella

Matteo Flora

What we know, and what we still don’t

Seventeen months of warnings, read by whom?

The elastic waistband of the fridge cabinets

A perimeter that belonged to nobody

And in Italy, where the NIS2 deadline is at the end of the month

Further reading

Theory

Sources

l'autore

Matteo Flora

aggiungi commento

cancella

leggi

Matteo Flora