When the cold chain is the attack surface

What happened

Overnight on 11-12 October 2026, threat actors reached the refrigeration controllers that keep the fridges and freezers cold across hundreds of French supermarket stores, and turned them into ovens. They triggered the controllers' built-in defrost cycle and pushed the temperature setpoint to +50°C. Display cases that normally sit near -20°C heated up, melting stock and, in some stores, sparking fires.

Around 300 Intermarché and Netto stores (Groupement Les Mousquetaires) were hit, together with outlets from Coopérative U, Carrefour Market, Monoprix, Leclerc and Super U, for a total in the range of 250 to 350 stores. Affected stores had to throw out all fresh and frozen stock. The losses run into tens of millions of euros. No customer data was touched; the entire impact was physical.

The target was known, patched and exposed

The hijacked devices were Danfoss AK-SM refrigeration controllers running outdated firmware. This was not an unknown zero-day. Earlier in 2025, researchers at Claroty's Team82 disclosed serious flaws in the Danfoss AK-SM 800A platform, and the US CISA issued advisories for CVE-2025-41450 (an authentication bypass) and CVE-2025-41451 (a command injection). Danfoss shipped fixes and repeatedly urged customers to keep systems updated. Many did not.

And these controllers are reachable. Internet scans found roughly 2,752 Danfoss systems exposed directly online, with Shodan tracking more than 4,500 Danfoss devices on the public internet. Known bugs, public patches, thousands of exposed devices running old firmware: the attack was less a breakthrough than a predictable outcome.

It was not only supermarkets

The French outage did not come out of nowhere. Weeks earlier, in late August 2026, at least six US military commissaries reported unexplained refrigeration failures and spoiled food across more than fourteen Air Force, Navy and Army sites. Those incidents are still under investigation and have not been formally attributed to anyone. But they hit the same class of equipment, and the French attack mirrored the same pattern. The point is uncomfortable and simple: the attack surface was a product, not a company.

This is a supply-chain attack

Frame it correctly and the lesson sharpens. This is a supply-chain, third-party attack on a shared operational-technology platform. Intermarché did not build these controllers. Neither did the other chains, nor the military commissaries. They all bought, and often remotely depend on, the same vendor's product. Compromise one widely deployed controller platform and you do not hit one victim, you hit everyone who runs it, across retail, logistics and defence, at the same time. The single-vendor dependency is the risk, and it sits in a part of the estate that most security programmes never look at.

Availability and integrity, not confidentiality

Most risk registers are built around data. They ask whether someone could read, copy or leak information they should not. That lens is necessary, but it is blind to this entire class of attack. Here the asset holds almost no sensitive data. Its criticality is availability (the fridges must run) and integrity (the setpoints must be trustworthy). A confidentiality-first assessment rates a refrigeration controller as low risk and moves on. The night of 11-12 October is what that blind spot costs.

What to do

• Inventory every OT and building controller (refrigeration, HVAC, BMS) with a named owner, not just IT assets.
• Rate criticality on availability and integrity, not only data confidentiality.
• Find and retire outdated firmware; check your estate against the Danfoss CVE advisories.
• Take controllers off the public internet; check your own ranges on Shodan before an attacker does.
• Segment OT away from tills and office IT; firewall and monitor it.
• Govern vendor and integrator remote access as third-party risk: who connects, how, when, with what authentication, and tier suppliers by the impact they can cause.
• Alert on unexpected setpoint changes, forced defrost cycles and out-of-hours access.
• Write the playbook for a cold-chain failure: detection, manual fallback, stock triage, store continuity.

What it means for your register

Model the business impact, not just the data. A refrigeration controller scores near zero on confidentiality and critical on availability and integrity, and the loss event is spoiled stock, closed aisles, wasted food and brand damage, not a privacy fine. Put the asset in the referential, record the single-vendor dependency behind it, run a business-impact assessment that captures the real consequence, map the supplier access that reaches it, and then score the risk. The attack is never the surprise. The surprise is the asset, and the supplier, you never assessed.

Based on public reporting of the 11-12 October 2026 incident (BleepingComputer) and on CISA and Claroty Team82 advisories for the Danfoss AK-SM 800A platform (CVE-2025-41450, CVE-2025-41451). Details may evolve as investigations continue; analysis and recommendations are Synapse Consulting's own.