Boarding the Cold Aisle

Hundreds of stores, one exposed product class, and a defrost cycle turned against the food it was meant to protect

Jeff Gray · 27 October 2026 · Updated 11 November 2026 · Control Systems Security

Updated 11 November 2026: see the appendix on France's attribution to Iran.

The cold aisle after a forced defrost. Illustrative image, not a photo of an affected store.

On the night of October 11 into October 12, 2026, someone reached into the refrigeration systems of French supermarkets and turned them against their own contents. Store refrigeration controllers were driven into long, forced defrost and heater cycles overnight. When staff arrived in the morning, cases that should have been cold were hot. Intermarché publicly cited temperatures around 50°C for roughly six hours. Food was thrown out, meltwater pooled on floors, and small fires were reported at some sites by news outlets and by the Paris prosecutor’s office, which opened a cybercrime investigation the same day. French Finance Minister Roland Lescure put the count at roughly 700 of about 10,000 French supermarkets. Chains named in coverage include Intermarché and Netto, Coopérative U, Carrefour, Monoprix, and E.Leclerc.

Following is speculative based upon publicly available information.

What follows is my own open-source synthesis and judgment. I have no inside knowledge of the investigation. The exact access method used that night has not been made public. Where something is confirmed by officials or vendors, I say so. Where I am inferring, I say that too.

Not building HVAC. Not a single HQ brain.

The first thing I want clear is what was hit, and what was not.

Reporting and France's CERT-FR describe internet-reachable, per-store refrigeration system managers: Danfoss AK-SM and AK-SC, plus Copeland and Dixell XWEB. These boxes sit above a store's pack compressors and case controllers. They hold setpoints, defrost schedules, alarms, and HACCP temperature logs. A refrigeration contractor often reaches them through a cellular or IP modem for remote service.

That is not building comfort HVAC. Coverage talks about cold aisles, fridges, and freezers, not store air conditioning. It is also not a proven multi-site cloud console. Journalists and researchers counted many individually exposed store interfaces.

So cooling is "central" inside one store: one plant, one system manager. Across a retail chain, there is no single HQ HVAC brain for this attack. Each store is its own OT island. The wave looked coordinated because the same product class was exposed the same way in hundreds of places, not because someone owned a national refrigeration dashboard.

Nominative architecture (one store)

What reporting describes at a single site. This is refrigeration plant control, not building comfort HVAC, and not a national HQ console. The thumbnail below opens a larger diagram with the internet-facing detail: public IP, HTTP/HTTPS management UI, StoreView / XWEB fingerprints, and the two common edge paths (contractor 4G/LTE modem versus store port-forward).

×

On the public side, the management face is a normal web UI: HTTP on port 80 and/or HTTPS on port 443, often with a StoreView or XWEB title, favicon, or TLS name that internet search platforms can fingerprint. Behind that sits either a contractor 4G/LTE cellular modem with its own SIM and public IP (frequently outside the store firewall and outside the retailer’s inventory), or a store router port-forward / DNAT onto the system manager’s LAN address. CERT-FR and Pen Test Partners both describe the healthier pattern as a retailer-owned VPN or allowlisted path with no public management UI at all. That preferred path is drawn on the diagram; it is not what the open record says was widely in place.

Same pattern repeated across many stores

The wave looked coordinated because the same product class was exposed the same way in hundreds of places. Each store is its own OT island.

×

What the damage looked like

The physical effect is confirmed: overnight override of refrigeration control, forced or extended defrost, elevated case temperatures, precautionary discard of fresh and frozen product, meltwater, and fires cited by the Paris prosecutor’s office and by several outlets. Worker reports of even higher temperatures should be treated as local anecdotes, not industry-wide confirmed maxima.

Intermarché CEO Thierry Cotillard told BFM that losses amounted to "tens of millions of euros nationwide in a single day." Coopérative U described smaller stores at several tens of thousands of euros and hypermarkets up to roughly €200,000. Those are executive estimates, not a closed national audit. Lescure said there was no risk to France's food supplies, while calling the event a wake-up call. IRIS analyst Sébastien Abis framed it as a significant hit to the retail cold chain, not a general collapse of farm-to-fork logistics. Serious store-level harm. Not a national famine scenario.

What is still exposed across Europe

CERT-FR's alert (CERTFR-2026-ALE-012) names Danfoss AK-SM and AK-SC series, plus Copeland XWEB and Dixell XWEB. Prior research, including Claroty Team82's August 2025 work on the AK-SM 800A (CVE-2025-41450) and Synacktiv's 2023 findings on older units, had already mapped authentication and post-auth issues on some of these families. ANSSI Director General Vincent Strubel told the French Senate on October 21 that the agency's analysis points to elementary exposure and weak or default admin credentials, and he pushed back on media claims that those researcher CVEs were the exploited path. Treat the published bugs as known soft spots, not confirmed incident TTPs.

Some of the gear cannot be fixed in place. Legacy AK-SM 800 and AK-SC 355 no longer get security updates. Copeland's XWEB EVO line reached end of software support on March 16, 2026. CERT-FR is blunt: a factory reset of end-of-life gear left on the public internet is not enough. It will be re-compromised.

Reuters, citing Onyphe, reported at least 4,500 Danfoss interfaces still viewable mid-week after the incident. Censys figures cited by SecurityWeek put nearly 3,000 internet-exposed Danfoss StoreView panels on October 11, more than 1,800 of them in France. By October 14 the French count had fallen to about 537, with little change elsewhere, consistent with disconnect rather than patch. Sekoia's Félix Aimé told outlets that Spain, Portugal, Poland, Germany, and Belgium were also affected. I have not found named victim retailers or national CERT victim lists for those countries. Treat that as an analyst assertion, unverified at the victim level.

Ahold Delhaize detected malicious IT activity around October 12 and took down websites and e-commerce. Dutch authorities have said they do not believe that IT incident is connected to the refrigerator attacks. My reading: concurrent coincidence until someone shows a technical link. Different impact mode. Enterprise IT versus OT refrigeration supervisors.

What reconnaissance would have taken

This does not look like a long campaign into one supermarket company's corporate network. It looks like someone who hunted for common store equipment already reachable from the internet.

Find the boxes. Claroty had already shown StoreView-class interfaces were enumerable on public internet search platforms. Reuters used Shodan after the incident. That the October operators reached many store controllers remotely is confirmed by the outcome. That they used any particular search engine is not confirmed.

Fingerprint the product. Distinctive banners make these managers recognizable. Pen Test Partners note that contractor cellular remotes commonly place the system manager on a public IP the retailer does not own.

Get through authentication. Public research describes date-derived "code of the day" style bypasses on some units, and ANSSI has confirmed weak or default passwords on internet-exposed gear. Which path the October operators actually used remains undisclosed.

Know the process. Pen Test Partners argue that simply raising a setpoint drifts a case toward ambient air. Reaching around 50°C implies forcing defrost heaters to stay on and defeating normal termination, then pushing those settings across case controllers while suppressing alarms. Automating that across hundreds of stores overnight implies scripting plus refrigeration literacy. Experts still describe the barrier as low relative to a classic deep ICS intrusion.

Probable kill-chain (speculative)

Following is speculative based upon publicly available information. The exact access method used on the night of October 11-12 has not been disclosed. What follows is the most probable path that fits CERT-FR’s affected product list, ANSSI’s elementary-hygiene framing, researcher reconstruction (especially Pen Test Partners), and the observed overnight defrost effect. Confirmed facts are labeled. Everything else is inference.

1. Reconnaissance: find the exposed controllers. Enumerate internet-reachable refrigeration system-manager interfaces by product fingerprint (HTTP title, favicon, TLS subject such as DanfossSM800A, StoreView banners). Claroty, Censys, Onyphe, and Shodan citations all show this population of devices was inventoriable that way before and after the incident. Confirmed: those interfaces were publicly enumerable. Not confirmed: that the October operators used any named search engine.
2. Boarding: authenticate to the system manager. Gain admin on the store supervisor (Danfoss AK-SM / AK-SC StoreView path, or Copeland / Dixell XWEB on other stores using that gear). Public research describes date-derived login codes on some Danfoss generations and weak or default passwords on internet-exposed gear; ANSSI has endorsed the weak-password / open-admin class of failure and has pushed back on treating researcher CVEs as proven incident TTPs. Confirmed class: unprotected or weakly protected admin on public IP. Undisclosed: which credential path the operators actually used.
3. Living off the land: abuse legitimate refrigeration functions. From the system manager, push settings to the store’s case controllers. Raising a setpoint alone only drifts a case toward store ambient air. Reaching the reported ~50°C range implies forcing electrical defrost heaters to stay on and defeating normal defrost termination (timer and/or sensor), which are ordinary parameters in vendor manuals. Suppress or mute temperature and defrost alarms so overnight staff and monitoring do not get a clean page. Confirmed effect: prolonged defrost / heater behavior overnight. Strong inference (PTP and process manuals): heater force-on plus termination defeat, not a custom malware implant on the controller. Aimé told CNN the operators do not appear to have used malicious code on the fridge controllers.
4. Scale: repeat across a target list. Script the same parameter change across many public IPs / stores overnight, spanning multiple retail brands that share the same vendor and contractor remote pattern. Confirmed outcome: hundreds of French stores, multi-chain. Inferred: automation plus enough refrigeration literacy to apply a repeatable pattern.
5. Impact: spoilage, meltwater, and fires as side effect. Food leaves safe temperature; chains discard stock; meltwater pools; at some sites heaters run far outside design duty and contribute to reported fires. Pen Test Partners argue the fires look like a side effect of continuous heater duty on weak electrical points, not a separate arson payload. Confirmed: food loss and prosecutor-cited fires. Inferred: fire mechanism.
6. No proven persistence narrative. Public remediation centers on removing internet exposure, factory reset of compromised units, and firmware hygiene. CERT-FR warns that reset alone on end-of-life gear left on the internet is not enough. There is no public claim, no reported ransom, and no disclosed implant left behind. Working judgment: the campaign’s published signature is remote reconfiguration of legitimate control functions, not a deep planted backdoor story.

In my framing, the first two steps are the Boarding Attack: a target of opportunity on what was already sitting on the pier. The middle steps are living off the land: weaponizing built-in defrost and alarm functions instead of dropping custom malware. Taken together, that pairing is the probable kill-chain I am willing to defend from public sources. A long siege of a chosen retailer’s corporate IT is the weaker fit on the same record, and I am not going to dress the weaker fit up as the main story just because it sounds more dramatic.

Living off the land, and boarding the target of opportunity

Living off the land means abusing legitimate functions already on the system, rather than dropping custom malware. That fit is strong. Aimé told CNN the perpetrators do not appear to have used malicious code on the fridge controllers. Pen Test Partners describe damage through forced defrost heaters, ordinary parameters, and alarm disable. CERT-FR remediation centers on removing exposure and firmware hygiene. My confidence is high that the impact mechanism was legitimate controller logic.

Boarding Attack is my term for a target of opportunity: find what is already exposed and weak, and board it, rather than laying siege for months to a chosen hard victim. That fit is also strong. What got hit was many identical internet-exposed boxes with known hygiene failures, correlated across chains by shared vendor and contractor patterns. ANSSI framed elementary defects. The France-heavy footprint lines up with denser French exposure counts, which is where the doors were. A deep planned campaign into chosen retailers looks weaker: no reported dwell in retailer corporate IT, no claim, no custom malware narrative from ANSSI.

The best fit I can defend on the open record is both at once. Someone boarded an already-exposed device class, then weaponized built-in refrigeration functions, especially prolonged defrost, without needing a novel OT implant on the controller. That pairing is what lets a relatively unsophisticated access path produce a very physical result.

Walk up one hop: the contractor path as another possible vector

Following is speculative based upon publicly available information. I am not asserting that any refrigeration contractor was compromised, or that any intelligence service posed as one. I am examining the full landscape of activity that sits one hop above the cold aisle, because that is where remote access usually lives.

What the open record actually puts in the middle

The remote path into these stores usually does not start at the supermarket's IT desk. Reporting and CERT-FR's own remediation language put a third party in the middle: the refrigeration contractor, the frigoriste, who fits the plant, keeps the system manager reachable for remote service, and often depends on that data feed for contract performance. Pen Test Partners describe the common shortcut: a cellular modem on the controller, on a link the retailer often does not own, cannot see, and may have no record of. CSO Online quotes Coopérative U's Dominique Schelcher that U stores buy from refrigeration contractors, not from Danfoss directly, and that those contractors supply the controller, configure it, and keep remote access. E.Leclerc told AFP a cyberattack affected one of its refrigeration equipment suppliers, with repercussions on refrigeration in several stores. Sources close to that line pointed at Danfoss as the manufacturer. CERT-FR tells operators to check insurance terms before cutting the internet data feed to the prestataire frigoriste, and allows emergency filtering of frigoriste source IPs as a temporary step. That is official recognition that the contractor path is part of the attack surface.

What is not in the open record: named frigoriste companies for the hit stores, a published roster of who held those remotes, or proof that any service firm's corporate network was the entry point. The named foreign entities are the controller makers (Danfoss in Denmark; Copeland and Dixell under a US group), which is normal for this equipment class in Europe. Foreign manufacturer is not the same thing as a foreign intelligence cutout. French install and maintenance firms appear in ordinary project posts across the industry. That only shows the shape of the market. It does not identify who maintained the stores that were hit.

Ways this hop can matter, without declaring which one happened

The first and simplest reading is still the one the public facts support best. Someone finds the store supervisors on the internet, gets through the weak or known login class that ANSSI and researchers have described, and pushes the defrost abuse from store to store. In that reading the contractor is not the villain of the story. The contractor is the reason the door exists. A cellular modem hung for convenient remote service puts the management interface where anyone can find it. Nobody has to break into the frigoriste's office for that to work. I think that path was available. I also think it was enough, on its own, to produce what France saw that night. I am not saying the investigation will close there. I am saying you do not need a deeper story to explain the damage.

A second reading sits next to that one and deserves space even though nobody has proven it. The same night hit more than one retail brand. One way to get that kind of reach is to board each public interface separately. Another way is to misuse access that already spanned many sites: shared technician passwords, a contractor monitoring portal, a VPN concentrator, or a small set of service accounts the maintenance firm used across its book of stores. If investigators later name a service company, a shared credential set, or a portal that tied those chains together, this reading gets much stronger. Until then it stays plausible and unproven. I include it because pretending the only door was a lonely public IP would be dishonest about how this industry actually works.

A third reading belongs in a full landscape even though I am not claiming it is what happened in October. In the abstract, an adversary who wants durable and deniable reach into many cold aisles has good reasons to prefer the maintenance layer over a one-off smash of a single retailer. Winning or buying trusted remote-maintenance access can look entirely ordinary for years: hire into a real frigoriste, subcontract under a larger firm, acquire a small service company, or stand up a convincing maintenance front that bids for cold-aisle work the way every other bidder does. Once inside that role, the actor installs or inherits the same remote path the industry already uses: cellular modem, vendor cloud feed, VPN, or shared portal. The work looks like competent technician work. Over time the same person builds a quiet inventory of stores, models, firmware, alarm paths, and defrost parameters. That inventory is legitimate for the job and devastating if it is ever abused. When the moment comes, the abuse does not need custom malware on the controller. It uses the same legitimate functions already described in the kill-chain: force the defrost, defeat termination, mute the alarms, and run the change across the book of sites. Because the link often never crosses the store's owned firewall, the people who would normally notice an exposed management interface may never see the traffic at all.

I want that abstract picture on the page because operators and investigators should be willing to look at the service layer, not because I have evidence that an intelligence service or a long-cover cutout ran this attack. Ordinary poor hygiene can produce the same outside appearance. Hundreds of stores, one night, and legitimate defrost abuse fit a scripted boarding of public interfaces just as well as a quiet misuse of service access. ANSSI has talked about elementary exposure and weak or default admin. Pen Test Partners have argued that no insider was required. The hit spanning Danfoss and Copeland/Dixell fits a shared exposure class at least as well as a single planted contractor, unless someone invents several cutouts without naming them. So I examine the contractor hop as a real class of vector. I do not invent a named company behind it, and I do not put a flag on anyone's lapel.

What this means for anyone who still owns a cold aisle

Either way, the practical conclusion does not wait for perfect attribution. If your cold aisle is reachable because a contractor hung a modem on it, that contractor is already inside your OT perimeter, whether or not their office was ever hacked. The contract should name every remote path into the equipment and forbid any other. Access should come through a path the retailer owns, with accounts tied to named technicians and logs the retailer can read. The contractor should have to tell you when a controller leaves vendor support or when a vulnerability is published. You should be able to revoke that access without losing the cold chain. If you cannot answer those questions without calling the frigoriste first, you do not control the perimeter. You are renting it. After France, that is a business decision with spoiled food and fire reports attached to it, not a paperwork preference.

Attribution, kept honest

Through at least mid to late October 2026, nobody has publicly claimed this attack, and no ransom demand has been reported in the coverage I have seen. The Paris prosecutor’s office and ANSSI are working the case. The exact exploit chain has not been disclosed. ANSSI’s public posture is elementary misconfiguration, not a showcase of novel zero-days.

When I rank what the open record can support, opportunistic abuse still sits at the top. There is no claim and no demand, and several experts have described an open door rather than a deep intrusion into retailer corporate networks. The scale pushes back a little on the “bored kid alone” caricature, because hundreds of stores and more than one vendor imply some organization and some scripting, but organization is not the same thing as a named advanced group. I treat that reading as reasonable and unfinished.

Hacktivism or political sabotage belongs next, not because anyone left a manifesto, but because the overnight timing and the quieting of alarms look like intent to maximize spoilage before morning staff arrived. A France-heavy footprint could mean a political target. It could also mean France simply had the densest pile of exposed panels. I will not pretend those two explanations have been separated in public.

The August 2026 U.S. commissary disruptions belong in the conversation and stay inconclusive. I walk through that parallel below. Without edge-hardware detail I will not claim the same product class. Criminal extortion is weak on the present record because no demand has been reported. The contractor-layer path from the prior section stays in the landscape as another possible way someone could have reached many stores. I examined how that could be orchestrated in the abstract. I am not saying that is what happened.

I will not assert a state or hybrid food-security pressure story. Cold chain is strategically attractive. Attractiveness is not attribution. ANSSI has talked about hygiene, not APT tradecraft, and inventing a nation-state narrative out of exposed supervisors and weak admin would be exactly the kind of leap this article is trying not to make. What I am willing to say is narrower and less satisfying: unattributed abuse of exposed retail refrigeration supervisors, with enough process knowledge to turn defrost into damage, and with several deeper stories still possible until the investigation publishes more than it has.

Update, November 11, 2026: France has since attributed the attack to Shahid Kaveh, a unit affiliated with Iran's Revolutionary Guard. See the appendix for what that changes and what it does not.

Are these devices discoverable elsewhere?

Yes. The same product class that got boarded in France is still inventoriable from the public internet in many other countries. That is not a guess about who got hit. It is what internet search platforms already publish about banners, titles, certificates, and favicons that identify these management interfaces.

For Danfoss StoreView, Onyphe reported about 6,200 unique public IP addresses across 95 countries and territories in mid-October, with France nearly half the set, then Belgium, Poland, the United States, the Netherlands, and Spain. Censys counted roughly 3,000 StoreView panels on October 11, of which about 1,825 were in France. France then fell to 537 by October 14 as operators pulled gear offline. Hosts outside France moved far less in the same window, which is consistent with a France-heavy response rather than a global takedown. Shodan queries cited in secondary reporting put several thousand StoreView panels online after the weekend, with France still first, and South Africa, the United States, Portugal, Belgium, Germany, and others in the next tier. Portugal alone was reported with roughly 140 Portuguese-IP Danfoss management interfaces in one specialist Shodan check, with no confirmed Portuguese supermarket victim.

For Copeland and Dixell XWEB, the map is even less France-centric. Onyphe put XWEB EVO at about 1,960 public IPs across 65 countries, led in their sample by Italy, Belgium, Greece, Spain, and France. XWEB PRO was smaller but still multi-country. Copeland Site Supervisor, a related supervisory line, showed a North America-heavy footprint in the same Onyphe work, with the United States and Canada together near 70 percent of that product’s exposed IPs. Forescout’s later Shodan-based survey counted about 13,000 refrigeration-control service observations across roughly 6,000 public IPs in 99 countries, of which about 7,000 were Copeland/Dixell XWEB observations and about 4,700 were Danfoss StoreView. Those are service observations, not a clean count of physical stores.

A few limits matter. Exposed does not mean compromised. An IP with a StoreView or XWEB face can sit behind NAT, belong to a contractor, or serve more than one downstream plant. Firmware version is not always visible from the outside, so a reachable panel is not automatically a date-code login. I did not scan anything for this article. The numbers above come from Censys, Onyphe, Forescout, Shodan citations in open reporting, and national CERT warnings such as Belgium’s CCB echo of CERT-FR. What those sources support is simple: anyone who can type a product fingerprint into an internet search engine can still find these boxes outside France. The boarding opportunity was never a French-only inventory problem.

Remaining attack-surface estimate (public counts only)

Here is the rough residual surface after France’s pull-down, stated as an estimate from other people’s scans, not as a victim count.

Where does that leave the residual boarding opportunity? Even after France yanked most of its StoreView panels offline, the public scan picture still looks like thousands of interfaces worldwide in this product class. I will not pretend any one of those scanner totals is a precise census. Different platforms disagree, NAT hides how many plants sit behind an IP, and firmware state is often invisible from the outside. What I will say is that the order of magnitude did not collapse with the French weekend. Outside France the counts barely moved while French hosts dropped hard. That is what a local disconnect campaign looks like, not a global cleanup. Anyone still hunting this product class with a search engine has work left to do, and so do the operators who have not yet asked whether their own boxes are in someone else’s results.

US commissary parallel (Aug 2026)

In late August 2026, roughly August 26 and 27, refrigeration failed at multiple Defense Commissary Agency stores across the United States. Installation notices and reporting named sites including Fort Irwin, F.E. Warren Air Force Base, Fort Huachuca, Naval Station Newport, Travis Air Force Base, Columbus Air Force Base, and others. Public tallies run from about six confirmed stores up to roughly fourteen or eighteen depending on the source. The Defense Department only acknowledged a "possible refrigeration disruption."

At Fort Huachuca, freezers reportedly went into defrost overnight while electrical power stayed on, and frozen food spoiled. Army CID's Cyber Field Office, Air Force OSI, and DCIS opened investigations, with DCIS described as lead. As of this writing, no agency has publicly confirmed unauthorized access. Software fault, configuration error, contractor action, or a shared monitoring failure remain live alternatives. The U.S. events are not confirmed to be cyber.

In late October, The Telegraph reported that Army CID is working with DCIS and French law enforcement to understand the European refrigeration outages. That is investigative comparison. It is not a published finding that the same actor or the same exploit tied August and October together. No shared indicators of compromise have been released. No claim of responsibility on either side.

Here is the limit I will not cross. Without public information on the edge hardware at the affected commissaries, I cannot name a technical similarity to the French store supervisors. I do not know whether DeCA used Danfoss, Copeland, Dixell, or something else entirely. Inventing a shared product class would be tidy and wrong. What the open record actually supports is thinner and more honest: similar overnight defrost outcomes, parallel investigations that are now comparing notes, and no proven common mechanism. Same actor and same campaign remain unproven. I am not persuaded they are linked on the evidence published so far. I am persuaded they belong in the same OT conversation, because both stories are about refrigeration control, remote reach, and what happens when defrost stops being a maintenance function and starts looking like a weapon. That is as far as the public facts go, and I am leaving them there.

What an attacker would learn for next time

This is speculative, grounded in what the incident demonstrated was easy. Scale the same remote setpoint and defrost abuse against remaining internet-exposed controllers, preferring end-of-life units that cannot be patched. Move upstream from store aisles to warehouses, distribution centers, and food-manufacturing cold rooms. Look sideways at pharma refrigerators, vaccine storage, and blood banks. ANSSI has already flagged health-sector use of similar equipment. Run multi-country same-night waves. Pair OT spoilage with headquarters IT ransomware. Collect quiet footholds on cellular refrigeration controllers for later effect, and time the abuse so alerts stay muted until morning shift. None of that requires nation-state resources. It requires the boarding opportunity this attack already proved exists.

What operators should do

Pull refrigeration system managers off the public internet. If a contractor needs remote access, put it behind a retailer-owned VPN or an allowlisted path you control, not a cellular modem that advertises a management UI to the world. Patch current-generation firmware where patches exist. Migrate end-of-life AK-SM 800, AK-SC 355, and XWEB EVO gear off the network edge. Treat the contractor's remote as your attack surface. Watch for abnormal long defrost cycles and muted temperature alarms. Those signatures can look routine if nobody is looking.

None of this needs exotic detection. It needs the willingness to admit that the cold aisle is OT, and that OT on a public IP is a physical problem waiting for a boarding pass.

Closing

The French supermarket fridge attack was not magic, and it does not become clearer by dressing it up as something it has not been shown to be. What the open record describes is an exposed class of store refrigeration supervisors, reached remotely, and then abused through functions those supervisors were designed to perform. The food spoiled because defrost heaters did what they are built to do, for far longer than they are meant to run, while the alarms that should have woken someone stayed quiet. My reading of that pattern is a boarding attack carried out by living off the land: find what was already on the pier, then use the plant’s own controls against it.

I have also walked one hop up the chain, into the contractor layer, because that is where remote access usually lives in this industry. Direct boarding of public interfaces still fits the published facts best. Misuse of legitimate service access, and even the abstract possibility of long-cover access through a maintenance role, belong in a complete landscape. They are not claims I am making about who did this. They are reminders that the cold aisle’s perimeter is often rented, not owned.

The lesson I would take from October is not that refrigerators suddenly became a nation-state target. The lesson is plainer and harder to dismiss. Any process controller that combines remote setpoint authority with a face on the public internet will eventually meet someone who treats that combination as an invitation. France paid that bill in spoiled stock, meltwater, and fire reports. The rest of the map still has plenty of the same doors standing open.

Sources

• France Diplomatie - Declaration of attribution to Iran of cyber attacks against France (Nov 2026)
• CERTFR-2026-CTI-009 - Activites cyber offensives ciblant la France menees par des acteurs iraniens lies au CGRI (9 Nov 2026)
• CNBC - France blames Iran for supermarket refrigerator cyberattacks, weighs sanctions
• CERTFR-2026-ALE-012 - Incident ciblant les controleurs a distance des installations de refrigeration
• Claroty Team82 - Freeze the Controller, Defrost the Food
• Claroty - France supermarket hacks / internet-facing refrigeration
• Pen Test Partners - You don't need a nation state to warm up a fridge
• BBC - Fridges in French supermarkets hit by cyber attack
• NBC / Reuters - Investigators hunt hackers who heated French supermarket fridges
• AP - Cyberattack hits 700 supermarkets in France
• CNN - What to know about the supermarket fridge cyberattack
• The Guardian - Who hacked France's supermarket fridges?
• SecurityWeek - Attack widens to Copeland, Dixell
• Public Senat - ANSSI - defauts de securisation elementaire (Strubel, 21 Oct)
• IRIS - Cyberattacks on the supply chain / food security
• Synacktiv - Auth bypass SM800/SC255/SC355 (2023)
• Military Times - DoD commissary refrigeration disruption
• Stars and Stripes - CID/OSI investigate commissary refrigerator outages
• CNEWS - Pentagon cooperation with French fridge probe
• The Telegraph - Pentagon investigates French fridge hack after failures on US bases
• Censys - Frostbitten in France (StoreView exposure)
• Onyphe - Danfoss StoreView exposure
• Onyphe - Copeland/Dixell XWEB exposure
• Forescout Vedere Labs - Cold Chain, Open Control
• CCB Belgium: warning echoing CERT-FR

Appendix: France attributes the attacks to Iran (11 November 2026)

On November 9, France put a name on this. The Ministry for Europe and Foreign Affairs formally attributed the October 11 to 12 attack on refrigeration controls at more than 700 French retail sites to Iran. France says the work was carried out by Shahid Kaveh, an offensive cyber unit affiliated with the Islamic Revolutionary Guard Corps. Paris summoned Iran's ambassador and says it will push for new EU sanctions. Iran's foreign ministry rejected the accusation as baseless.

The technical case comes from the C4, the French government's cyber crisis coordination cell (ANSSI, DGSE, DGSI, DGA and COMCYBER), published by CERT-FR as CERTFR-2026-CTI-009. It gives no confidence percentage. It lays out a body of evidence: attack infrastructure that was also used in the same period for Modbus port 502 reconnaissance against Schneider Electric gear, a technique tied to the unit since at least April 2026; the FOFA scanning tool; the attack relayed on the unit's CyberbanNews outlet starting October 13; and traces of Farsi in the infrastructure. The Paris prosecutor adds IP addresses pointing to devices in Iran and is seeking international arrest warrants.

That changes part of what I wrote above. "Unattributed" and "no claim" are no longer the record, and the state actor story I declined to assert is now the official French position. The hacktivist angle fits too, because France says this unit hides behind hacktivist personas such as CyberAveng3rs. What it does not change is the access story. Nothing published describes a novel exploit. The prosecutor describes takeover through the controllers' web interfaces, unlimited defrost cycles, and silenced temperature alarms. The attribution covers France. It says nothing about the August U.S. commissary outages, and I am still not linking them.

For defenders the job is the same, now with a name on it. A state unit used a public scanner to find the same exposed panels anyone can find. Take the controllers off the internet, kill default credentials, and put contractor access behind a path you own and log. Sources: French Ministry for Europe and Foreign Affairs statement, CERT-FR CERTFR-2026-CTI-009, CNBC on the prosecutor's findings and Iran's denial.

This article is an analysis of publicly available reporting, vendor bulletins, and CERT advisories only. Exposure figures are cited from third-party internet search platforms and published research, not from any scan performed for this piece. No active scanning, probing, or unauthorized access was performed. No specific private facilities or operators are identified beyond what public reporting has already named.

← Back to Articles