The Attack That Turned the Freezers Into Ovens

Overnight, someone reached into the refrigeration systems of hundreds of French supermarkets and told them to heat up. By morning, shelves of food that had been chilled the day before were headed for the dumpster, and the CEO of one of France's largest grocery cooperatives was calling the attack "unprecedented."

No ransom note. No stolen customer records. Just spoiled inventory, closed freezers, and a very expensive Monday.

If your company doesn't sell groceries, you might be tempted to file this under "somebody else's problem." Please don't. This story is a clean, concrete illustration of a question every board should be asking: what are the machines in our business that no one thinks of as computers, and who is watching them?

What we know so far

Prosecutors in Paris opened an investigation on Monday into what they called a large-scale attack on connected refrigerators at several major French food retailers. The French government asked its national cybersecurity agency, ANSSI, to investigate and said it is coordinating with European counterparts.

Carrefour said 80 of its supermarkets were hit. Les Mousquetaires, the group behind Intermarché, told reporters that roughly 150 to 180 of its stores were affected, depending on the report. Cooperative U, Monoprix and others were also named. Reports vary on the total, and no official industry-wide figure has been published. Media accounts say the attackers pushed target temperatures to about 50°C (122°F) for several hours; those temperature figures come from press reports and store posts, not from an official investigation.

The equipment maker, Danish company Danfoss, acknowledged incidents affecting "a limited number" of its refrigeration management systems in France. Its position: the affected units were running outdated firmware, and customers had long been urged to update. Investigators have not publicly said how the attackers got in, and no group has been identified. The French government said that exposing a management interface to the open internet is "contrary to best practices."

In August, security firm Claroty published research on flaws in a Danfoss controller line. Nobody has publicly tied that research to this attack, and I am not suggesting a link. But the pattern is familiar. A flaw is disclosed, a fix exists, and a gap opens between "a patch is available" and "the patch is installed on every device in the field."

The real lesson: your business has a thermostat problem

Every company has them. The badge readers on the doors. The building controls that run the HVAC in the data center. The sensors in a cold-chain warehouse. The industrial equipment on the plant floor. The point-of-sale terminals. These devices run software, connect to networks, and often sit outside the reach of the IT team's normal patching and monitoring routines. Frequently, they were installed and maintained by a facilities manager or a vendor, not by anyone with "security" in their title.

In my book, Cyber Risk Is Business Risk, I argue that the most dangerous gap in most organizations is not a technology gap. It is an ownership gap. The refrigeration controller is a perfect example. Who owns it? Facilities? Operations? The vendor? IT? When the answer is "all of the above," the real answer is usually "nobody."

Three questions for your next board meeting

The Three Questions framework from the book translates directly:

1. What are we trying to protect? For a grocer, it isn't just the customer database. It's the cold chain. For your company, it might be the production line, the delivery schedule, or the lab freezer that holds ten years of research samples. Name the physical processes your revenue depends on.

2. How would we know if it were compromised, and how fast? Reports suggest some equipment ran hot for hours before staff noticed. Speed of detection is the difference between a bad morning and a lost week. Ask whether anyone is monitoring these systems for abnormal behavior, or whether you would find out the way these retailers apparently did: when the food went bad.

3. If it happened tomorrow, what's the plan? Not the IT recovery plan. The business plan. Where does the inventory go? Who calls the insurer? Who talks to customers and regulators? Do you know what your cyber insurance policy says about physical damage caused by a cyber event? Many policies were written with data breaches in mind, not spoiled inventory.

Compliance is not the same as protected

A company can pass every audit on its list and still have an internet-facing management console for a machine nobody inventoried. Compliance frameworks tend to focus on the systems auditors know to ask about. Attackers don't care what's on the audit checklist. They care what is reachable.

This is the compliance-versus-security distinction at its sharpest. If your last assessment covered laptops, servers and cloud accounts but never counted the connected equipment in your stores, plants and warehouses, you have a blind spot with a price tag attached. One retail executive put the nationwide loss for a single day at tens of millions of euros. That is one executive's estimate, not an audited figure, but even a fraction of it dwarfs what it typically costs to inventory and lock down these devices.

Vendors are part of your risk

Danfoss says its customers were told to update. Its customers presumably believed the equipment was someone else's job. Both can be true at once, and that is exactly the problem. Contracts with equipment vendors should say who is responsible for patching, how quickly security fixes must be delivered, and who tells you when a flaw is found. Ask to see it in writing.

What to ask your CISO this week

• Do we have a complete inventory of connected operational equipment (refrigeration, HVAC, building controls, plant machinery), and who owns each category?
• Which of these devices can be reached from the internet? The answer should be "none, unless there is a documented reason." Remote access for vendors should be locked down to approved addresses with strong authentication.
• Which are running outdated firmware, and what is our deadline for fixing them?
• Are these systems monitored, and would an alarm reach a human who knows what to do at 3 a.m.?
• Does our cyber insurance cover physical and inventory losses from a cyber event, and have we tested that assumption with our broker?

If the answers come back vague, that's not a failure of your CISO. It's a signal that this risk has been nobody's job. Make it someone's job, and put a date on it.

The French retailers will recover. But a lot of food, and a lot of trust in "it's just a thermostat," went in the trash overnight. Don't wait for your own version of this story to ask who is watching the machines.