When the fridge becomes the attack surface

On 12 October, refrigerators and freezers in roughly four hundred French supermarkets were pushed toward 50°C overnight. Fresh and frozen stock worth millions of euros was lost. Nobody breached a data centre. The attackers reached refrigeration controllers — the same class of device that keeps cold stores, server rooms, laboratories and plant buildings inside their operating envelope.

Three weeks later it happened again. On 2 November, stores in Belgium, Sweden, Ireland, Estonia, the Netherlands, Luxembourg and Finland reported controllers misbehaving, with chains including Carrefour, Intermarché, Ikea, Coop, ICA, Delhaize and Kesko named in press reports. The mode of access is reported to have been internet-reachable refrigeration controllers running unpatched vendor software. A full technical account has not been published, and the impact of the second wave is still being assessed.

What is confirmed — and what is not

• First wave: 12 October 2026, roughly 400 French stores, including Coopérative U, Intermarché, Carrefour, Monoprix and E.Leclerc.
• Mechanism reported by the BBC: unpatched refrigeration software, with units driven toward 50°C.
• Second wave: 2 November 2026, seven European countries, with Danfoss and Copeland controllers reported as internet-exposed.
• No public attribution has been made. Investigators and vendors have not released a technical post-mortem.

One thing is not in doubt: this was not a data breach with an operational side effect. It was an operational incident, delivered through controllers that were never treated as security-relevant. That distinction matters for every facility in the Kingdom that runs the same device class.

A freezer is an OT asset

Refrigeration controllers are small industrial computers. They run compressors, regulate setpoints, watch temperatures and raise alarms. They are usually installed by a refrigeration contractor, maintained by facilities, connected to a building or plant network for monitoring, and given a remote-access path so the vendor can diagnose faults without travelling. In most estates, nobody owns their patching.

That makes them OT in substance and orphaned in practice. The same pattern applies to air-handling units, pump controllers, access-control panels, CCTV encoders, energy meters and the rest of the ELV estate — devices that keep a building or a process inside its operating envelope, sit on a flat network, and disappear between the IT inventory and the maintenance contract.

The physical consequence is the point. A stolen database is a legal and reputational problem; a controller that drives a cold store to 50°C is a stock loss, a food-safety event and a contractual failure, all in one night. Security teams tend to rank availability below confidentiality because their training is in data. Operations teams rank it the other way round, because they watch the process. Neither view is complete on its own.

Three failure modes this attack exposed

Controllers reachable from the internet

A remote-access path created for a vendor's convenience often outlives the fault it was opened for. Once a controller is reachable from outside, it can be found by scanning, without any knowledge of the site. The freezer incidents were reportedly built on exactly that exposure: controllers addressable from the internet, not a sophisticated intrusion into a hardened network.

Software with no owner

Unpatched refrigeration software is not negligence in the ordinary sense. It is what happens when a platform is nobody's asset: not in the IT patch cycle, not in the vendor SLA, not in the commissioning handover as a security item. Attackers do not need a zero-day when the patch has been available and unapplied for months.

Alarms with no response path

Freezers have temperature alarms. The question is where they terminate. If telemetry goes to a facilities inbox, a local buzzer or a dashboard nobody watches overnight, the first responder is the staff member who opens the store. Damage is discovered, not detected. The same is true of process alarms in a plant room.

What to check this week

• Inventory what is reachable from outside: refrigeration, BMS, AHUs, pumps, access control, CCTV and metering. Ask each vendor for the exposure they created, including temporary paths that were never closed.
• Put controllers on their own segment. A freezer controller has no business sharing a flat VLAN with office IT or with the corporate wireless network.
• Name an owner for every controller platform, with patching and firmware in the maintenance contract — not assumed to be someone else's job.
• Terminate process and temperature alarms in a monitored console with a tested escalation route, and log who touches each controller.
• Write the fallback: what operations does manually, and who decides, when controllers behave unexpectedly.

Where compliance fits

The NCA OT Controls and ECC-2 already ask for asset inventory, network segmentation, controlled remote access, monitoring and incident response. This incident is what those requirements look like when they are absent — not a gap in the standard, but a gap between the standard and the maintenance contract. For HCIS-regulated facilities, the same control set carries a physical-security consequence: a controller that opens a gate or moves a camera is also an OT asset.

The evidence that matters is not a certificate on the wall. It is a current list of reachable devices, a network diagram that shows the controller segments, and a log that shows who accessed what and when. Those artefacts are also what an auditor can test, which is why they are worth building before the next incident rather than after it.

IEC 62443 gives the design vocabulary — zones, conduits, security levels — and the useful discipline is to apply it to the ELV and refrigeration estate, not only to the process control system. If a device can change a physical condition, it belongs in the assessment.

The uncomfortable part

Retail made the headlines because the damage was visible in shop aisles. Industrial and commercial facilities run the same controllers with higher stakes: a chilled-water loop, a cold store, a control room, a gate. The question is not whether these devices are OT. It is whether anyone can prove, tonight, which of them are reachable, patched and monitored.

Lantern's OT and cyber compliance practice starts with that proof: an exposure assessment that inventories internet-reachable controllers, reviews remote-access paths and the vendor contracts behind them, and produces a findings register operations can act on. It is deliberately unglamorous work — the kind that decides whether an incident is a bad night or a bad quarter.

If you want a starting point, we can run the assessment against a single site and show you what is exposed before you commit to a wider programme.