French cybersecurity authorities have expanded their list of compromised refrigeration systems, instructing supermarkets to immediately disconnect internet-connected units following a weekend cyberattack that destroyed chilled food inventory at hundreds of locations. The French Computer Emergency Response Team (CERT-FR) issued the warning after additional refrigerator control models joined those already confirmed as vulnerable. The attack revealed that attackers could simply log into exposed control panels with public IP addresses, effectively accessing the off switch for entire refrigeration systems from anywhere on the internet.

CERT-FR's Monday advisory initially identified only Danfoss AK-SC and AK-SM series refrigeration controllers as compromised, urging stores to upgrade firmware, switch security settings to "strict," and replace default passwords. But as victim counts climbed, it became clear that not all affected retailers were running Danfoss equipment, prompting authorities to add models sold under the Dixell and Copeland brands to the vulnerability list. Groupement Mousquetaires, which runs the Intermarché and Netto chains, was among the hardest-hit operators and immediately pulled products from affected fresh and frozen display cases managed by Danfoss controllers. The emergency guidance tells supermarkets to remove any refrigeration control systems with public IP addresses from the internet and reconnect them only through secure VPN connections after verifying configurations and, where needed, restoring factory settings.

Tom Hegel, research lead at SentinelOne, warned that "with thousands of these interfaces still online, I expect more incidents like this." Dixell, a French control systems vendor, posted on LinkedIn after the attack that "cybersecurity is everyone's business, all the time," noting that "today, our competitors were targeted; tomorrow, it could be our turn"—a prediction that proved accurate when its own systems appeared on the vulnerability roster. According to the report, Hegel said that "retail chains run enormous estates of refrigeration controllers, building management systems, door access panels, and point-of-sale gear, much of it installed by facilities contractors who rarely loop in the security team."

The vulnerability exists because supermarkets frequently purchase "refrigeration as a service", arrangements where vendors guarantee performance and cold chain traceability in exchange for continuous data streams from the equipment they maintain. That business model requires constant internet connectivity, leaving control interfaces exposed online—a reality that has largely escaped chief information security officers' attention until now, the report notes. Like much legacy operational technology, these refrigeration systems were deployed by facilities contractors who typically don't coordinate with security teams, creating blind spots in corporate cybersecurity defenses. The nature of the attack makes attribution nearly impossible: an intruder who logs into an exposed control panel leaves almost no traces behind, with no malware to examine and few clues beyond an IP address that likely points to a rented server, the report explains. As Hegel put it, "a teenager and an intelligence service would look much the same from the defender's side."

Supermarket security chiefs now face the challenge of scanning and securing sprawling networks of building management equipment while grappling with unanswerable questions about who attacked them and why. The report notes that "the gap between a nuisance and a serious incident often comes down to how much control a victim has exposed to the internet," underscoring that the attack's severity stemmed from the sheer accessibility of critical systems rather than sophisticated hacking techniques. CERT-FR recommended that stores requiring immediate access could temporarily filter connections to allow only their refrigeration suppliers' or service providers' IP addresses to connect, though it cautioned this shouldn't become a permanent fix. The broader takeaway is stark: operational technology that seemed too mundane to threaten corporate security has proven vulnerable at scale, and thousands of similar interfaces remain online and exposed. The incident forces a reckoning between the operational convenience of remote monitoring and the security risks of internet-connected industrial systems—a tension that won't resolve without fundamental changes to how facilities equipment is procured and monitored. Retailers who've long treated refrigeration as invisible infrastructure now confront the reality that every networked system is a potential entry point.