- During the night of 11 to 12 October, attackers took over refrigeration controllers in hundreds of French supermarkets and heated fridges and freezers to as much as 50°C.
- The damage wasn’t one fridge. It was the same attack in hundreds of stores in one night. The problem wasn’t the breach, it was the spread.
- Third-party remote access to “monitor their systems” often comes with full control. Separate monitoring from control, and only switch control on when it’s needed.
- Start with one system: apply the five steps of Zero Trust to a single cooling or building system your supplier manages.
“Why would you hack a fridge?”
That was the question we heard most two years ago, when our SOC trainees were hacking cooling and water systems for Hack the Hospital. A fair question: they had taken control of a cooling system, but real-world cases were still hard to find, and most people saw a clever exercise rather than a real risk. That changed on Monday morning, when hundreds of French supermarkets showed why it is one.
If you’re a CIO, there’s a good chance you didn’t sign the contract for your organization’s cooling, climate control or building management. Facilities did, or operations, or the supplier set it up as part of the installation. That’s exactly why this attack matters to you. It went after a system everybody depends on, maintained by somebody else and watched by nobody.
What happened
During the night of Sunday 11 to Monday 12 October, attackers took control of refrigeration controllers in supermarkets across France. Instead of cooling, the systems were made to run their built-in defrost function. By opening time, some fridges and freezers had reached 50°C. Stock had to be destroyed, and fires were reported.
Affected chains include Intermarché, E.Leclerc, Netto and Coopérative U, with Carrefour and Monoprix also named in reports. Intermarché CEO Thierry Cotillard put the loss at “tens of millions of euros across the country in one day”. A single store in Alsace reported €220,000 in damage. The Paris prosecutor has opened an investigation, and the French national cyber agency ANSSI has been asked to investigate.
The controllers came from Danish manufacturer Danfoss and were reportedly running older versions of the control software. Intermarché said the attack reportedly affected a service provider that manages refrigeration in its stores. How the attackers got in has not been confirmed.
What we do know: two vulnerabilities in this controller family were published in 2025, and on the day of the attack, researcher Baptiste Robert of Predicta Lab counted more than 2,700 Danfoss systems reachable from the internet, about 1,600 of them in France.
And Albert Heijn?
The same weekend, Ahold Delhaize took systems offline after what it calls a cybersecurity incident. In the Netherlands, Albert Heijn could not deliver online orders, electronic shelf labels showed wrong prices, and some distribution centers stopped.
Some coverage linked the two incidents. Ahold Delhaize says there is no reason to assume a connection, and so far nothing points to one.
Why this is an OT story
Most organizations don’t see a fridge as a computer. It’s equipment. It sits in the facilities budget, not the IT budget. That is exactly what makes it interesting to an attacker:
Someone else manages it
Stores rarely have refrigeration engineers on site, so a service provider manages the controllers remotely.
Its software rarely gets updated
The cooling works, and updating it is someone else’s job.
Nobody is watching it
If it’s not on the IT team’s asset list, it’s not on anyone’s monitoring screen either.
The damage is physical
Spoiled food, fire risk and empty shelves, not a locked file share.
The same goes for air conditioning. Replace “fridge” with the climate control of an operating room, or the water used for sterilization, and you have the scenarios from our Hack the Hospital demo. In one, the HVAC controller that regulates air and temperature is compromised through a shared maintenance VPN. In the other, attackers use the building management interface to tamper with water pressure and disinfection.
One night, hundreds of stores
A single broken fridge is a bad morning for one store manager. What made this attack expensive was its reach: the same command, in hundreds of stores, on the same night.
Signal
That’s the real lesson. You can’t guarantee that no attacker ever gets into a cooling controller. Software ages, vulnerabilities get published, and suppliers get breached. What you can control is how far one compromise reaches. If each store’s controllers can only be reached through one controlled route, by the people and systems that need them, a compromise stays in one place. If one access point reaches every store, a compromise reaches every store.
Containment comes first. Monitoring is the second layer, and here it would have mattered too. A refrigeration controller constantly reports what it’s doing: temperatures, setpoints, defrost cycles. Defrost cycles running for hours, in hundreds of stores on the same night, are about as abnormal as behavior gets. The signal was there for hours. But at three in the morning, for a system outside IT’s view, nobody was looking.
Hospitals, factories and distribution centers run around the clock, and attackers know when the people watching them go home. So limit what an attacker can reach, and make sure someone notices when they try.
Your supplier is part of your network
According to Intermarché, the attack reportedly went through a service provider that manages refrigeration in its stores. If that is confirmed, it’s a familiar story. Your OT security is only as strong as the remote access your suppliers use to support it.
That access exists for good reasons. A supermarket chain can’t send an engineer to every store each time a freezer needs adjusting, and a hospital can’t keep an HVAC specialist on every floor. Remote management saves time and money. Often it’s even a condition of the contract: no remote monitoring, no guaranteed response time or warranty. So the business signs, and IT may never hear about it.
The problem is how that access is usually set up:
Monitoring that comes with control
The supplier asks for access to monitor “their” system. In practice, the same connection that reads temperatures can also change setpoints. Monitoring data only needs to flow out. Control access should be a separate connection that is switched on when it’s needed.
Always on and shared
One VPN or remote tool, permanently open, often with the same login used across all of the supplier’s customers.
Around the firewall
Some suppliers install their own 4G router or cloud gateway next to the machine, which bypasses your network controls entirely.
Never reviewed
Set up at installation, then forgotten.
Target’s 2013 breach began with network credentials stolen from a refrigeration and HVAC contractor. The contractor’s access was for billing and project management, and from there the attackers reached the checkout systems in Target’s stores. What makes supplier access dangerous is the multiplier: one compromised supplier can reach every customer and every location it connects to.
Questions to ask your supplier
Some questions you can ask a supplier this week:
- Which of our systems can you reach, and from where?
- Is your access always on, or only switched on when you need it?
- Do your engineers use individual accounts, or one shared login?
- If your own systems were compromised, what could an attacker do in ours?
The last question is the uncomfortable one. Most supplier contracts cover response times and uptime. Very few cover what happens when the supplier becomes the way in.
IT and OT are one attack surface
It’s tempting to file this under “OT problem” and hand it to facilities. That would miss half the story.
Attacks on OT rarely start in OT. They start with something very IT: a stolen password, a phishing email, a VPN account that was never switched off. In Hack the Hospital, the attack on the water systems begins with leaked VPN credentials. It is an IT foothold that ends in a physical consequence. If the supplier route in France is confirmed, that attack also started on the IT side: the supplier’s own systems and the remote management platform that connects them to hundreds of stores.
It works the other way too. Whatever caused the incident at Albert Heijn, its impact didn’t stay on a server. Shelf labels showed the wrong prices, distribution centers stopped, and shelves went empty. When IT goes down, the physical operation goes down with it.
That is why separating IT security and OT security into different teams, tools and budgets leaves a gap in exactly the wrong place. The attacker moves from an office laptop or a supplier account to a controller, and the handover between the IT team and the OT team is where nobody is watching.
The answer is one view across both: the same Protect Surfaces, the same policy model and the same monitoring, whether the asset is a mail server or a freezer. That’s how we run MDR Prevent™ across IT, OT and cloud.
The question your board will ask
We’re not glad this happened. Store owners lost their stock, food went to waste, and staff spent Monday emptying freezers instead of serving customers.
But it does change one conversation. Until this week, an attack on cooling or building systems sounded theoretical to most boards. Now it has been on the evening news, with empty fridges and a damage estimate in the tens of millions. Expect the question at your next board meeting: could this happen to us, and how far would it spread?
Where to start: Zero Trust for one fridge
You don’t need to solve all of OT this week. Pick one system that looks like this one: a cooling, climate or building system that a supplier manages for you.
Zero Trust can sound like a large program for large IT estates. Applied to one system, it’s surprisingly concrete. These are the five steps John Kindervag defined when he created Zero Trust, and the steps we use with every client:
Define the Protect Surface.
Name the system and what you lose if it stops, in money and in operations. That tells you what to protect first.
Map the transaction flows.
What does it legitimately need to talk to? Usually the units it controls, a monitoring system, and the supplier’s support connection. That’s a short list, and anything else is suspicious.
Architect the environment.
Put it behind a policy enforcement point, so it can’t be reached directly from the internet or from the office network.
Create the policy.
Allow only the flows from step 2. Monitoring data flows out. The supplier gets control access to this system only, when they need it, with their own account. A compromise at the supplier no longer reaches every location at once.
Monitor and maintain.
Watch the traffic and the behavior. If someone does get in, a defrost command at three in the morning triggers an alert, not a surprise at opening time.
None of this requires replacing the controllers or waiting for a firmware update. It changes who can reach them and how far a compromise can travel. For systems like these, containment matters more than patching. Our Field CTO Rob Maas explains why in Patching cannot be your primary OT control.
See it for yourself
Hack the Hospital runs these attacks live on real OT systems. You see how an attacker gets in through maintenance access, what that does to climate and water systems, and what stops it. Sessions run at your location, at ON2IT HQ in Zaltbommel, or virtually.
Final signal
Systems everybody depends on, maintained by somebody else, should not be watched by nobody. And when the breach lands, it should stay in one store. You can’t stop the breach. You can stop the spread.
Sources
Get in touch
Want to know how far a compromise of your building systems would reach?
Talk to us, and we’ll map it with you.
Talk to usFAQ
Was the Albert Heijn incident caused by the French fridge attack?
There is no evidence of that. Ahold Delhaize has said there is no reason to assume a link between the two incidents.
How do you secure third-party remote access to OT systems?
Separate monitoring from control: monitoring data only flows out, and control access is a separate connection that is switched on when the supplier needs it. Give each engineer an individual account instead of a shared login, limit each supplier to the systems they support, put those systems behind a policy enforcement point so they can’t be reached directly from the internet, and monitor for abnormal commands. A compromise at the supplier then no longer reaches every location at once.
How did the attackers get into the cooling systems?
That has not been confirmed. Reports say the Danfoss controllers were running older software and were managed by a service provider. Vulnerabilities in this controller family were published in 2025, and thousands of these systems were reachable from the internet on the day of the attack.
Why does this matter outside retail?
Hospitals, factories, data centers and logistics hubs all depend on cooling, climate and water systems that are often managed remotely by a third party. The pattern is the same: critical to operations, outside IT’s view, and reachable from outside.
What is the first step?
Make a list of the building and cooling systems your suppliers manage remotely. Check which ones can be reached from the internet, and what you would lose if they stopped overnight.
Rob Maas is Field CTO at ON2IT, part of the CTO Office under CTO Lieuwe Jan Koning. He works on product strategy and architecture for AUXO, MDR, and ZTaaS, shaping ON2IT's Zero Trust customer journey and AI feature roadmap. He is also a Palo Alto Networks Cyberforce Hero.