Overnight from October 11 to 12, 2026, attackers took over refrigeration controllers at hundreds of French supermarkets and forced them into defrost mode, pushing some fridges and freezers to 50°C. At Intermarché, the heat lasted six hours and the chain threw out all affected food (SAN, 2026). Carrefour, Monoprix, Coopérative U and E.Leclerc also reported affected stores, and Paris prosecutors opened an investigation that covered food losses and fires. The controllers came from Danfoss, the Danish manufacturer, which said most of the affected systems were older products that no longer received software or security updates. Félix Aimé, an analyst at Sekoia, said the attack also reached Spain, Portugal, Poland, Germany and Belgium.

The technical failure was ordinary, and the reason it went unfixed shows up in almost every enterprise budget I see.

Claroty and Danfoss flagged the weakness months before the attack

Danfoss named its AK-SM800 and AK-SC355 refrigeration management systems as the main products hit. These boxes sit in the back room of a store and let a technician adjust temperatures and start defrost cycles from off site, which is why some of them connect to the internet. On August 9, researchers at Claroty Team82 published vulnerabilities in the Danfoss AK-SM 800A, and Danfoss fixed them for supported units in firmware versions 4.2 and 4.3.1. The company said it had long advised customers to update supported systems and migrate legacy units to current models.

The exposure was still wide on the day of the attack. The Shodan search engine tracks more than 4,500 Danfoss devices reachable over the internet (BleepingComputer, 2026), and the French scanning firm Onyphe told Reuters that a small minority of those devices appeared to run the latest software. France's National Cybersecurity Agency, ANSSI, also reported compromises involving remote control modules from Copeland, so the problem reaches past one vendor.

Owners had two months of public warning before the night of October 11.

A device near write-off is the hardest replacement to fund

Technology teams struggle to get buy-in for updating old software, and the struggle gets worse at the edge. Many chief financial officers and other leaders treat the request as a problem that should go away on its own. Many refrigeration controllers and building management panels in service today were built years ago, before newer security safeguards for connected equipment existed. The team asking for money has to argue for spending on something finance expects to write off soon, and that is a painful meeting to walk into.

I understand the finance view. An asset close to the end of its depreciation schedule carries almost no book value, and replacing it early looks like waste. An attacker sees the same device as an unpatched controller with a public internet address, connected to your operations, that no one on your team monitors.

Attackers come in through that gap.

European regulators have started to close it for new equipment. The European Union's Cyber Resilience Act requires manufacturers of connected products to state how long they will provide security updates, with its main obligations applying to products sold from December 2027. The units already bolted to the wall in your stores and plants fall outside that rule, so they remain your responsibility.

US water utilities hit the same weak spot in July

On July 30, 2026, the FBI and the Environmental Protection Agency warned that attackers had reached internet-facing controllers at water and wastewater utilities in at least seven states (FBI and EPA, 2026). The targeted devices were Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 controllers. Attackers changed device addresses and passwords, which cut off monitoring and in some cases control, and utilities reported loss of pressure and flooding. The agencies also noted that a third party had set up networks the same way across several customers, which may have let the attackers repeat their success from one utility to the next.

The French supermarkets and the US utilities run different equipment from different vendors, and both were exposed through a public internet address and access set up by an outside provider. Camille Campbell, writing on the Ericsson Cradlepoint blog, said critical operational technology systems "should never be directly exposed to the internet."

The federal advice speaks to the budget problem in this post. The FBI and EPA ask owners to keep a rolling 12-month forecast of end-of-life equipment, and to put compensating controls with firm decommission dates on any device they cannot replace yet. You can hand finance that schedule, with dates and owners, in place of an open-ended request.

The agencies also ask owners to test that they can run operations by hand, and to compare running controller programs against a known-good copy before trusting a backup. A store team that can switch its cold cases to manual control can stop an attack like the one in France without waiting for the vendor to respond.

Take the device offline before you ask for replacement money

France's national computer emergency response team, CERT-FR, issued an alert asking owners to disconnect uncompromised refrigeration managers from the internet, along with any other unit carrying a public address. Woolworths in Australia told customers its fridges run without links to outside networks, which limits exposure to this kind of attack. Neither step needs a capital request.

Split the work in two and you can finish the urgent part without waiting on the budget fight. Your team can take the controllers off the public internet this quarter and route technician access through a virtual private network with multifactor sign-in, paid for out of the operating budget. Replacement then becomes a separate, planned conversation with finance, and you walk into it having already lowered the risk.

Pulling a controller off the public internet takes a change ticket, and finance never has to sign it.

Price the replacement against one bad night

The French retailers threw out fresh and frozen stock, and some display cases stayed out of service into the next day. Intermarché alone reported between 150 and 200 affected stores (SAN, 2026). When you take the replacement request to your CFO, set the cost of a new controller next to the cost of one night like that across your own sites, and the request becomes an inventory protection case.

Here is what I would put on the list before this happens to you:

• Find the devices facilities owns. Scan your own address space the way an attacker would, and list every controller and gateway with its firmware version and end-of-support date.
• Put end-of-support dates next to depreciation dates. When finance sees both in one register, the conversation about write-off timing includes the risk timing.
• Rewrite the service contract. Intermarché and E.Leclerc both traced the attack to a company that manages or supplies their refrigeration equipment. Your contract should say who patches and how fast the provider must tell you about an incident.
• Subscribe to advisories for the gear you own. Claroty published its research two months before the attack.
• Add a temperature alarm that runs on its own. An independent sensor gives store staff a warning that does not depend on the controller an attacker has taken over.