Lessons Learned from the French Refrigeration Attacks

Cybersecurity incidents can have consequences far beyond stolen data. For a supermarket, losing control of refrigeration can mean spoiled inventory, interrupted operations, and lost revenue.

That connection became clear in October 2026, when cyberattacks disrupted refrigeration systems at hundreds of French supermarkets. Reports described abnormal temperature increases that forced stores to discard fresh and frozen products. For the employees and businesses affected, the recovery involved both restoring equipment and safely replenishing inventory.

The incident raises a question relevant to organizations in every industry: Do you know which connected systems your business depends on—and how those systems are protected?

What we know

France’s national cybersecurity agency, ANSSI, through its CERT-FR alert, confirmed compromises involving refrigeration controllers in the Danfoss AK-SM and AK-SC series, as well as Copeland and Dixell XWEB equipment. The alert identifies exposed management interfaces as a security concern and recommends removing direct internet exposure.

According to reporting by the Associated Press, Danfoss said most affected systems were older products that no longer received software or security updates. That is an important distinction: it does not establish that every affected system was unsupported or that one particular failure explains every compromise.

As of October 16, the precise entry points and full sequence of events across affected locations should not be treated as settled. Publicly documented vulnerabilities can help explain potential risks, but they do not, by themselves, prove which techniques attackers used in a particular incident.

Additionally, a similar attack succeeded against United States Department of Defense commissaries throughout the continental US. Due to the nature of this incident being classified and investigated as a national security issue, it is unknown if the same Danfoss equipment was in-use at these sites, but the attack played out the same and had the same impact as the French attacks.

Why connected equipment deserves attention

Refrigeration controllers are part of operational technology, or OT: systems that monitor or control physical equipment and processes. Unlike a compromised email account, a compromised controller can directly affect the operation of machinery or the conditions needed to preserve inventory.

These systems can also have different replacement cycles and maintenance requirements from everyday office technology. Equipment may remain useful long after its connected controller stops receiving security updates. Replacement can require coordination among operations teams, technology staff, equipment vendors, and service providers.

Those constraints deserve recognition. They also make it important to identify unsupported systems early and plan how to protect or replace them.

Practical lessons for business leaders

1. Know what your operations depend on

Maintain an inventory of connected systems that support critical operations. Identify who owns each system, who maintains it, who can access it remotely, and whether its software and hardware remain supported.

Include equipment managed by outside service providers. Responsibility for maintaining equipment and responsibility for securing its remote access should be explicit.

2. Review remote access with your service providers

Remote management can be valuable, but the access path needs appropriate protection. CERT-FR recommends restoring access to affected refrigeration controllers only through a secure VPN or protected network. Its guidance also calls for configuration reviews, manufacturer-recommended updates, and changes to default passwords. This would require that all existing control interfaces which are visible on the public Internet be configured so that they are restricted to VPN and on-network accessibility only.

Coordinate changes with the people responsible for the equipment. Disconnecting remote access without understanding its purpose could interrupt monitoring or maintenance services.

3. Plan for the end of support

A functioning device is not necessarily a supported device. Track support deadlines and include replacement costs, testing, and downtime in operational budgets.

When immediate replacement is impractical, work with qualified equipment and security specialists on interim protections and a defined replacement timeline. Those protections should address the system’s exposure and business importance; they should not become an indefinite substitute for lifecycle planning.

4. Prepare for disruption

Ask what happens if a critical system becomes unavailable or its settings cannot be trusted. How will the organization be alerted? Who receives the alert? Who can safely intervene? How will the organization maintain operations, protect inventory, and verify that service can resume?

For refrigeration, that planning should involve the people responsible for equipment operation and food safety. Cybersecurity response and operational recovery need to work together.

The broader business lesson

The French refrigeration attacks illustrate how closely digital access and physical operations can be connected. They also show why security conversations need to include operations leaders and equipment providers alongside IT.

For business leaders, a useful starting point is straightforward: Which connected systems could stop us from serving our customers, and who is accountable for managing that risk?

Answering that question helps turn a distant news story into practical preparation for your own organization.