What the French Supermarket Fridge Hack Teaches Us About OT Security

When I first read about the French supermarket attack, my honest reaction was that it sounded like a movie plot. Hackers quietly take over the refrigeration systems of many grocery stores overnight, crank the temperatures up, and leave staff to find puddles under the freezers in the morning. It reads like a season finale.

Then I read the technical details, and the Hollywood feeling went away. Nothing about this looks like a movie plot. It looks like an ordinary day on a penetration test. Internet-facing management interfaces, old devices that no longer get updates, and a maintenance setup that nobody in the business really owns. That should worry security leaders, because it describes a lot more than French fridges.

I test networks for a living, and OT and ICS environments are some of the most interesting and most fragile places I get to work. This post covers what happened, what is still unknown, and what the incident means for anyone running connected equipment that was installed once and then forgotten.

What Happened in the French Supermarket Fridge Cyberattack

Recently, attackers took remote control of the refrigeration controllers at supermarkets across France. They put fridges and freezers into defrost mode and removed the limits that normally stop temperatures from climbing, which pushed some units far above safe levels.

Staff arrived to spoiled meat, ruined frozen goods and overheated equipment.

Several major grocery chains were affected, and retailers expect losses in the millions of euros. French authorities have opened an investigation and are working with European counterparts, since other countries may be affected.

One detail I like is that some stores kept their cold chain intact because staff and refrigeration contractors reacted quickly. Prepared people limited the damage. That is an incident response story as much as a security story.

The reporting so far points to basic security hygiene failures, with known weaknesses leaving the door open for whoever came looking.

What Is OT Security, and Why Do Fridge Controllers Count?

OT security is the practice of protecting operational technology, the systems that monitor and control physical equipment and processes. Pumps, valves, turbines, building controls and commercial refrigeration all fall into that group. A store's refrigeration controller manages temperatures, defrost cycles and alarms across dozens of display cases. It is a small computer whose whole job is to move heat.

That is why this incident belongs in the OT cybersecurity conversation and not only the IoT security one. The controller is a connected device with a web interface, so IoT security applies. But the consequence here is physical. The data stays intact while the food spoils and the equipment overheats.

When comparing OT and IT security, OT can flip the usual priorities. Availability and safety come first. Patching is hard because a reboot can mean a warm freezer. Fridge controllers fit that description exactly. Patching a controller can interrupt cooling in a working store, so updates tend to wait. That concern is reasonable. It is also how a known problem stays open for years.

What We Still Do Not Know About the Attack

Early coverage drew a straight line from published vulnerability research to the attack. The more careful reporting does not support that yet. French authorities have not publicly named the vulnerability, the software version or the way in.

Security researchers had published flaws in controllers of this type before the attack, but no one has tied those findings to this incident. Danfoss, whose controllers were named first, says most of the units hit were older models that no longer receive updates, with some newer units running outdated software. French authorities have named more than one vendor, so this does not look like a single-vendor problem.

The motive is unclear too. The lack of a claim or ransom demand has puzzled investigators.

I would rather admit what we don't know than guess. What is confirmed is the shape of the exposure. France's national cybersecurity agency told operators to disconnect the affected controllers from the internet or tightly filter access to them, and said exposing management interfaces to the internet goes against good practice. When an agency leads with taking the devices offline, the exposure itself is the story.

Why Internet Exposure Is the Real Risk for End-of-Life OT Devices

Many of the affected controllers were older models that the manufacturer no longer supports. They do not receive security updates, so a newly found flaw stays open. That is a real limitation, but age alone is not what makes a device dangerous. Old equipment is normal in OT. Controllers stay in service for years because they do their job, and availability comes first. An unsupported device that cannot be reached from the internet can keep doing that job safely.

The trouble starts when an old device is also reachable from the outside. It is a pattern anyone who tests OT environments will recognize. A device goes in and works, so nobody touches it again. Remote access gets added for convenience, and the vendor eventually stops supporting it. The asset list, if one exists, still lists a refrigeration controller at store 114. Nothing in the business process forces anyone to revisit who can reach it.

For devices that cannot be patched, taking the management interface off the public internet is the strongest control available. It removes the path an attacker needs without touching the equipment or interrupting cooling. Replacement is worth planning, but it can follow a schedule that operations can live with. Reachability is the part that should not wait.

None of this is new. Controllers like these have been exposed and attacked before, and the manufacturer has urged customers to plan replacements for older products. Internet scans after the attack still turned up thousands of similar management interfaces visible online, and most appeared to be running outdated software. What has been missing is an inventory that shows which devices are reachable, and a decision to close that access.

OT Network Segmentation and Remote Access Come First

If I could fix one thing in most OT environments, it would be the path between the internet and the controller. Remote access gets built for convenience. A maintenance company needs to adjust a setpoint at 2 a.m., so a management interface gets a public address. Years later it is still there.

That is the same pattern we described in our post on the Minnesota water systems. Exposed remote access and flat networks that bridge IT and OT keep showing up because they solve a short-term problem and cost nothing until the day they cost a great deal. A fridge controller on the public internet and a water system interface on the public internet are the same mistake in different clothes.

Good OT network segmentation does not have to be exotic. Take management interfaces off the public internet. Put remote maintenance behind a single managed entry point with multifactor authentication. Limit access to known IP addresses as a first step while you plan the real fix. Keep OT networks separate from corporate IT and from guest networks. The guidance from French cyber authorities for the affected controllers points the same way, and so does the manufacturer's own guidance.

None of this is glamorous. Plenty of organizations put it off because uptime matters and nobody wants to be the person who broke the vendor's access. That fear is fair. It is the reason changes like this need a plan, and the operators in the room.

Third-Party Risk Management for OT Devices

One of the most useful details in this story is who did not own the problem. In several cases the retailers did not manage these controllers themselves. They bought through refrigeration contractors who supply and maintain the systems, or relied on service providers who manage refrigeration inside stores.

These units were managed through outside contractors, so the question for any board is who had contractual oversight of their security. Operators share responsibility for how their equipment is configured, even when someone else installed it.

This is third-party risk management applied to physical equipment. Most programs I see focus on software vendors and cloud providers. Far fewer ask the refrigeration contractor, the HVAC maintenance firm or the building controls integrator how they secure remote access to the devices they manage.

Start with the contract. Ask each contractor how they reach your devices, what credentials they use, who else has those credentials and how they learn about firmware updates. Ask for an inventory of the equipment they manage on your behalf, including model and firmware version. A contractor who cannot produce one has told you something important.

How to Secure OT Devices and Networks

Securing OT devices mostly comes down to a handful of unglamorous steps done in the right order.

1. Build an inventory. List every connected controller, who manages it, its model and its firmware version. You cannot protect what nobody has written down.

2. Find what is exposed. Look at your own public IP ranges the way an attacker would. The same scanning services that turned up thousands of controllers are open to anyone.

3. Take management interfaces off the public internet. Where remote access is required, use a managed entry point with multifactor authentication and an allowlist.

4. Plan for end-of-life equipment. Isolate and monitor unsupported devices until they are replaced, and budget for replacement before the next incident forces it.

5. Change default and shared credentials, and apply the firmware updates that exist. Test them first and schedule them with operations.

6. Add monitoring and device-level limits. Equipment should verify where a command came from and whether it falls within safe operating limits. A freezer that rejects a command to run far above safe temperatures is a better freezer.

7. Write the response plan before you need it. Fast response by staff and contractors appears to have limited losses at some stores.

How Compass Approaches OT Penetration Testing

At Compass, our team is trained in testing the environments attackers stand to gain the most from reaching, including external and internal networks and OT/ICS systems. In OT work we look for the same things this incident put in the headlines. Management interfaces reachable from the internet, unsupported devices, weak or shared credentials, and flat networks that connect IT and OT. We find them, show you how an attacker would use them, and tell you how to close the path. We do it carefully and with your operators involved, because uptime matters to us too.

Penetration testing is one piece of the picture. IT risk assessments help you inventory and prioritize connected equipment, a vCISO can own third-party oversight and your security roadmap, and incident response planning makes sure your people know what to do when a controller starts behaving strangely.

Contact us today to schedule a penetration test before someone else runs one for you.