During the night of 11 to 12 October 2026, attackers reached the refrigeration controllers of French supermarkets over the internet and changed their settings. Display cases, cold rooms and freezers were forced into defrost; retailers reported temperatures of up to 50°C, and fresh and frozen stock had to be thrown away. France's finance minister, Roland Lescure, put the number of affected stores at about 700 of the country's 10,000 supermarkets.
On 12 October 2026, CERT-FR, the incident response centre of the French national cybersecurity agency ANSSI, published alert CERTFR-2026-ALE-012 on "numerous compromises" of remote controllers for refrigeration installations. It named the Danfoss AK-SM and AK-SC series; a second version on 13 October added Copeland and Dixell xweb systems, and a third on 16 October updated the recommendations. That same week ANSSI told retailers the attacks were likely still under way. No one has claimed responsibility, and Europol has confirmed it is in contact with the authorities in the affected countries.
The exposure was the flaw
CERT-FR's alert does not name a software vulnerability. It names the condition that made the compromises possible: management interfaces reachable from the public internet, which it calls contrary to good practice. Danfoss said most of the units hit were legacy products or current products running outdated firmware. It named the AK-SM 800, end-of-life since 2021, and the AK-SC 355, phased out in 2016, and said some current AK-SM 800A units on old firmware were also affected.
A supervisory controller of this kind runs every refrigerated case, cold room and compressor in a store. It has a web interface so that a refrigeration engineer can change setpoints, read alarms and schedule defrost cycles without driving to the site. Put that interface on a public IP address, keep it on firmware that no longer receives security updates, and anyone who finds it can do what the engineer does. According to reporting on the attack, the attackers triggered the controllers' built-in defrost function, and some defrost cycles were stretched from one hour to eight to delay the alarms. The damage came from a maintenance function used as designed, set by someone who should not have been able to reach it.
A system between facilities, IT and a contractor
CERT-FR's emergency advice shows how far the dependency reaches. Before cutting the data feed from a controller, it tells operators to check the contractual conditions of their insurance. Where immediate action is needed, it suggests filtering access down to the source IP addresses of the refrigeration contractors. The connection that exposed the controllers is the one the contractor uses for remote service and alarm monitoring, and one that insurance conditions may depend on. Before pulling it, an operator has to know who relies on it.
That is the decision to take to your own organisation. Refrigeration and cold storage, heating and ventilation, access control, lifts, energy meters, UPS and generator controllers: each is a networked computer with a vendor lifecycle, bought and maintained as building equipment. The contract usually sits with facilities, the remote connection was set up by the installer, and the device may not appear in the IT inventory or the vulnerability scan. Ask who is accountable for the security of those systems. If the answer is a maintenance contract rather than a named person, nobody has accepted the risk of leaving them reachable, and nobody has the standing to switch them off.
End-of-life is part of the same decision. A controller the manufacturer stopped supporting in 2021 can still run a cold room without fault. Keeping it in service is a legitimate choice, but it is a risk decision, and it should be taken by someone who knows the device is unsupported and online.
The way back has criteria
Disconnecting a controller from the internet takes minutes. Bringing it back is where the decisions sit. CERT-FR's sequence for compromised equipment is to remove internet exposure, restart the Danfoss unit or restore its factory settings, restore remote access only through a secured VPN or protected network, and then reconfigure it for service. It adds that a factory reset alone is insufficient: equipment that is still vulnerable will be compromised again. For units that were not compromised, it asks for updated firmware, the manufacturer's strict security mode and changed passwords.
As restore criteria, that means a controller goes back into service only when it runs supported firmware or has been replaced, has no public address, accepts remote sessions only through a controlled path with individual credentials, and has had its setpoints and defrost schedules checked against a known-good configuration. A unit that comes back after a reboot with the same exposure has not been restored. The person who signs that off needs to be someone who can refuse a contractor's request to reconnect "just for monitoring" until the criteria are met.
There is a second clock while the controllers are offline: temperatures still have to be watched and recorded. AP quoted a Paris store director whose early-morning alert saved most of his fresh fruit and vegetables, though not his frozen stock. If the temperature alarms run through the controller, they are offline with it, so continuity needs an alarm that does not, and a manual round with a paper log while the system is disconnected.
Where the regulation puts the responsibility
For organisations within the scope of NIS2, in force in the Netherlands through the Cyberbeveiligingswet since 15 August 2026, this is not only a facilities matter. Article 21(2) requires "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers" (point d) and "security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure" (point e). Article 21(3) asks entities to take into account the overall quality of their suppliers' products and cybersecurity practices. A contractor with a standing remote connection to a controller is such a service provider. Under Article 20, the management body approves these measures, oversees their implementation and can be held liable for infringements.
Whether a given retailer falls within scope is a separate question; NIS2's food sector covers businesses engaged in wholesale distribution and industrial production and processing. The point reaches further than food. Hospitals, pharmacies, laboratories and food producers run cold storage on supervisory controllers too, and where the organisation is in scope, those controllers are among the systems its measures must cover.
What prepared looks like
Authority. Each building system with remote access has a named owner, usually in facilities, and a named person, usually the IT or security lead, who may disconnect it, each with a backup. The board gives that person the mandate to cut a contractor's remote connection, so the decision does not wait until the contract owner can be reached at night.
Trigger. A concrete condition: a national CERT or the manufacturer reports active compromise of a controller model you run, or a controller on unsupported firmware is found reachable from the internet. Either condition means disconnect first and discuss afterwards.
Continuity. Temperature monitoring that does not run through the controller, with its own alarm path to a phone that someone answers at night. A manual inspection round and log while systems are offline. The contractor's on-site attendance agreed in the contract, so service does not depend on the remote link. A named person who decides what stock is discarded and who informs the insurer and affected customers.
None of this works without knowing where the controllers are: which building systems have a network connection, what firmware they run, and who can reach them from outside and by which route.
Which building systems in your organisation can a contractor reach from the internet today, and who has the authority to cut that connection tonight and decide when it comes back?
