Hackers remotely changed temperatures in roughly 700 French supermarkets this week, triggering defrost cycles that spoiled stock, pooled water beneath freezers and started fires. France’s national cyber agency ANSSI has opened an investigation into the nationwide attack, which Economy Minister Roland Lescure called “a wake-up call for everyone.” The incident makes one engineering point plain: devices left exposed on the public internet or running unsupported, end-of-life firmware are a predictable, high-impact target.
The exposed-controller problem
Reporting names the affected controllers: Danfoss, Copeland and Dixell. Before the attack, researchers found more than 1,700 instances of the Danfoss software exposed on the internet in France. Many of the impacted units “no longer receive software or security updates” or were “running outdated software,” Danfoss acknowledged. Copeland identified a “vulnerability” in a “discontinued, end-of-life generation of controllers.” Claroty had earlier noted a mechanism in the Danfoss AK-SM 800A family that “could be abused” to bypass normal authentication. Attackers exploited that weakness, abusing built-in defrost functions and removing safety limits to raise cabinet temperatures—some peaking at 50°C (122°F) and catching fire.
Outsourcing without oversight created a single point of failure
Retailers often outsource refrigeration management to third parties. Those firms may have left controllers reachable from the public internet or failed to maintain firmware. Ken Munro, a partner at Pen Test Partners, told CNN that unit management was likely “outsourced to a third party who gave little to no thought to maintaining the security of these fridges.” He added: “There was no business need for the fridge controllers to be accessible on the public internet.”
The consequences were operational and reputational. Major chains – Carrefour, Monoprix, Les Mousquetaires, Coopérative U – lost stock and faced disruption. Retail executives warned the cost could run into the millions. The episode shows that a blind spot in supplier oversight can trash tons of food and spark fires as readily as a vulnerability can be exploited.
When the management path is the attack path
The attack also highlights a common operational gap: when a remote controller can be seized from outside, the system itself often does not know it has been compromised. No group has claimed responsibility; French cybersecurity researcher Félix Aimé told CNN the perpetrators do not appear to have used malicious code on the controllers, potentially complicating efforts to track them down. The hackers’ motivation remains unknown.
For operators, the question is not whether to segment networks or patch firmware – those are table stakes—but what happens when the management path itself becomes the attack path. The answer is not more monitoring on the same channel the attacker controls. It is an independent way back in: an out-of-band recovery layer that first cuts the attacker off, then allows the rightful operator to send authenticated commands over a channel the attacker never touched. That is the operational gap the Stormfire patent family describes.
France’s incident should prompt one procurement question above all: if a third party loses control of your remote equipment, can you still act?
Related coverage: Thousands of refrigerators were hacked across France. How worried should you be? — CNN