Short answer: Check which devices outside your classic IT are directly reachable and who manages them. The attack on French supermarket refrigeration shows why.
What happened
In the night to 12 October 2026, unknown attackers switched networked refrigeration and freezer systems in hundreds of supermarkets into defrost mode. According to media reports, temperatures rose to up to 50 degrees for about six hours and goods were destroyed. The Paris prosecutor is investigating.
What the authorities say
CERT-FR, the French computer emergency response team, reports numerous compromises of Danfoss controllers. It calls management interfaces exposed to the internet bad practice and advises disconnecting the devices or filtering access tightly. ANSSI, the national cybersecurity agency, called it urgent. Danfoss said the affected systems mostly ran outdated firmware, and older models no longer receive updates.
Important: CERT-FR has not yet confirmed how the attackers got in.
Three checks for your company
- Inventory: Which devices outside classic IT are connected, such as cooling, building systems or cameras?
- Age: Which of them no longer receive security updates?
- Access: Who may connect remotely, and through which route?
Source: CERT-FR, ANSSI, Danfoss, media reports
Related: NIS2 Supplier Risk Checklist (free · 10 questions · 5 minutes)
Research as of: October 14, 2026 — Regulation evolves quickly; this post does not replace individual legal or professional advice.
