French Fridges Heated by Hackers, Slamming Supermarkets and Outing OT Vulnerabilities

What happened, why it worked, and what to do before your IoT and OT feed the next headline.

When news first broke from France, the reports sounded almost like a prank. Unknown hackers accessed refrigeration controllers across French supermarkets and jacked temperatures up to 122°F (50°C), according to NBC News. The incident affected approximately 700 facilities and caused millions of euros in spoiled food.

For those of us working in OT cybersecurity, two immediate questions came to mind: “What can we learn from this?” and “How can I prevent this from happening to my organization?”

What We Know So Far

On October 12, 2026, France’s national cybersecurity agency (CERT-FR) issued alert CERTFR-2026-ALE-012, updating it the following day with additional details. The alert warns of widespread compromises targeting remote refrigeration controllers manufactured by Danfoss, Copeland, and Dixell.

As of this publication, no threat actor group has claimed responsibility for the attacks.

CERT-FR cautioned that attack campaigns remain active and reiterated a fundamental security rule: management interfaces should never be exposed directly to the public Internet, and remote access should be restricted via secure VPNs or protected internal networks.

Why Refrigeration Controllers Make Such An Easy Target

A supermarket refrigeration controller is a specialized embedded system that manages compressor cycles, defrost schedules, and temperature alarms. To lower maintenance costs and respond faster, store owners typically hire third-party services to manage these units remotely over web interfaces. As a result, many controllers become accessible from the public Internet. These refrigerators are expected to run for years without outages, even though they sometimes need firmware updates.

This common setup creates a severe risk because attackers do not need to steal sensitive data to inflict damage. Simply altering a defrost timer or temperature setting takes seconds and causes physical disruption: spoiled inventory, empty store shelves, revenue loss, and complex cleanups. While vendor software updates and patching are critical components of a long-term defense, these devices often lack basic access controls and authentication safeguards, making additional network-level protections essential.

As CERT-FR emphasized, operating unpatched or end-of-life devices on open networks carries a near-certain probability of compromise.

The Lesson For Every OT and IoT Security Team

Relying on manual fixes and one-off patches is ineffective when automated attacks spread faster than routine maintenance windows. Managing hundreds of controllers, HVAC systems, and building IoT devices manually is complex and error-prone. To achieve lasting security, organizations need an automated cybersecurity platform that provides continuous end-to-end protection.

No single security control is foolproof – organizations cannot rely solely on detection, prevention, or mitigation in isolation. A resilient defense integrates all three capabilities continuously across three core requirements:

1. Automatically discover every connected asset. Manual inventories miss non-standard IT hardware like refrigeration and HVAC controllers. You cannot protect what you don’t know exists.
2. Continuously pinpoint active exposure and vulnerabilities. Automate the identification of devices exposed to the public Internet or vulnerable to active exploits, while monitoring network traffic for anomalous behavior.
3. Restrict the blast radius before an incident occurs. Enforce network segmentation so a compromised controller has far less ability to reach or pivot to critical internal networks.

How Asimily Automates End-to-End OT Protection

Asimily, the Proactive Cyber Asset Defense Platform, supports these key defensive layers to help reduce reliance on purely manual effort or single-point solutions.

Automated Asset Discovery. Asimily automatically identifies and logs every connected IoT and OT asset – including HVAC and refrigeration units – without disruptive network scanning.

Automated Risk Prioritization. Instead of forcing teams to manually sort through thousands of security alerts, Asimily incorporates MITRE ATT&CK Analysis to highlight the exact vulnerabilities attackers are likely to exploit first.

Segmentation Orchestration. Asimily generates and simulates isolation policies for Network Access Control (NAC) and firewalls to limit lateral movement, preventing compromised devices from easily moving across your network.

Threat and Response / Anomaly Detection & Forensic Packet Capture (PCAP). Asimily provides threat and anomaly detection across connected devices, paired with optional Forensic Packet Capture (PCAP) to give incident response teams the exact network data they need to investigate and resolve threats quickly.

By combining detection, prevention, and mitigation capabilities (and more) into a single platform, Asimily helps organizations strengthen their overall security posture and reduce operational risks.

What CERT-FR Recommended

CERT-FR provides practical guidance that applies to organizations worldwide. For systems that have not been compromised, CERT-FR recommends:

• Disconnect affected units from the public Internet, removing any direct public IP access.
• Review all system configurations, including setpoints and defrost schedules.
• Restrict remote access to secure Virtual Private Networks (VPNs) or isolated internal networks.
• Follow vendor security hardening guidelines, including updating firmware and changing default passwords.

For systems showing signs of compromise, CERT-FR recommends a full factory reset and reconfiguration before returning them to service. However, the agency notes that a reset alone only removes current persistence – without securing exposure, the device will quickly be compromised again.

What To Check This Week

Six things worth confirming before the next alert lands:

• Inventory every refrigeration, HVAC, and building control system, including units specified, installed, and maintained by third parties.
• Identify which of them hold a public IP or are otherwise reachable from the internet, and remove that exposure.
• Rank what remains by exploitability using ATT&CK Analysis rather than by raw CVSS score.
• Review configuration on the controllers you cannot patch: setpoints, defrost ranges, security mode, and default credentials.
• Segment the devices that cannot be fixed, so a compromise stays local.
• Plan replacement for end-of-life units where the vendor has published no fixed version.

Refrigeration was the target this time. The conditions that made this attack work are not specific to refrigeration, or to retail. Any connected device that performs a physical function, answers to a network, and runs software older than its own warranty sits in the same position. The useful question is not whether your organization has devices like that. It is whether you know them better than attackers.

Learn how Asimily can help secure your OT and IoT without operational disruptions.