cyber

Supermarket Fridge Hack: Pricing Building Control Risk

Sam Keogh

October 26, 2026

8 MIN READ

Fifty degrees, overnight

Overnight on Sunday 11 October, refrigeration systems at French supermarkets were reportedly manipulated so that fridges and freezers heated up, in some stores to as high as 50 degrees Celsius, according to Al Jazeera's report drawing on AFP and Reuters. Fires broke out at several stores. The number of affected stores depends on who you read: BleepingComputer, citing French media, put it at 250 to 350, while Industrial Cyber, citing AP, reported more than 700. The retailers named in the coverage include Intermarché, Coopérative U, Carrefour, Monoprix and E.Leclerc.

The cost is also reported unevenly. Al Jazeera attributes to the chief executive of Intermarché a loss in the tens of millions of euros nationwide in a single day. A Coopérative U statement, quoted by Cyber Daily, described the targeting of equipment essential to preserving fresh produce as "extremely serious and unprecedented".

How the attackers got in has not been publicly confirmed. BleepingComputer reports that no information is available on how the controllers were compromised, and Industrial Cyber, summarising Forescout's analysis, says the same about initial access and the people responsible. What the coverage does agree on is the kind of equipment: refrigeration controllers from Danfoss. Industrial Cyber, citing France's CERT-FR, adds that compromises also involved Copeland and Dixell remote-management systems. Danfoss told Al Jazeera the affected units were running outdated firmware. Security researcher Kevin Beaumont wrote that "there’s several thousand of them that are directly internet-facing", and he disputed early reports of an AI swarm. His view that basic security controls were simply absent is his own assertion, not a confirmed finding. Al Jazeera reports that the French prime minister ordered ANSSI, the national cyber agency, to investigate.

That is a French story about a French supermarket sector. So why should an Australian risk lead, or a security officer on a Defence-adjacent site, spend ten minutes on it?

The loss was physical, and it never came from a scanner

Check Point's Oded Vanunu, quoted by Cyber Daily, described what made this different from the usual incident: "Unlike attacks aimed at stealing data or encrypting files, the impact here is on the physical operation of the equipment itself, with direct consequences such as food inventory losses and potential safety hazards." No data was the target. Cyber Daily reports that he added that the attackers did not need sophisticated techniques, and that a refrigeration system's legitimate functions, such as defrost cycles, can be exploited once an unauthorised party has access.

Rapid7's Robin Long made the ownership point to the same publication: operational technology is part of the attack surface "whether or not IT owns it". That phrase is the heart of it. A refrigeration controller usually belongs to facilities or to a contractor, is maintained by a vendor who connects in remotely, and is invisible to the tools the security team uses every day.

What follows is our own argument, not something the reporting or any agency says. In our experience, controllers like these are often missing from the cyber risk register altogether, or sit in it as a single line such as "building services" scored from a questionnaire. They also cannot be scanned the way a laptop can, because probing a live control system risks disturbing the process it runs. So the register has no telemetry for them, and a missing number gets read as a small one.

We made the general version of this point in It wasn't an attack. That's why your risk register is wrong. An asset with no evidence behind it is not the same as an asset with low consequence. A fridge controller is a clean, physical example of exactly that.

Hundreds of stores, one way in

The more important lesson sits in the shape of the incident, not the temperature. Several retailers were hit overnight, across hundreds of stores, by something that looks like a shared path rather than hundreds of separate break-ins. Claroty's chief technology officer, Jason Pearce, explained to Cyber Daily how that works: attackers who reach a central management system "may then be able to change settings across multiple refrigeration circuits without accessing each fridge individually". Dutch supermarket operator Ahold Delhaize also said on Monday 12 October that it had taken some systems offline, and BleepingComputer notes there is no evidence yet that the two events are connected. We mention it only to show how hard it is, from outside, to tell what is shared and what is not.

Now picture the register view. Each store's refrigeration is a separate line, owned by a separate manager, rated Low because nothing has ever happened. Add them up and you get a respectable total made of small independent numbers. That arithmetic is wrong in precisely the case that matters. Stores that share a vendor platform, a firmware version or a remote-maintenance provider are not independent. They share weather. When the storm comes, it comes to all of them on the same night.

Illustrative only: twelve boxes stand in for hundreds of stores.

This is why the whole-estate number cannot be built by summing the parts. A model that treats each store as its own roll of the dice will tell you the chance of losing all of them at once is vanishingly small, and it will be confidently wrong. A model that lets linked risks move together gives a fatter tail: an honest worst case, not a comfortable average. The French night is what that tail looks like when it arrives.

What one bad night is made of

Ask what the dollar figure for a night like this contains and the answer is a list of different things held by different people. There is stock that has to be thrown away, and Cyber Daily reports a company spokesman saying that all food in the impacted fridges was disposed of to avoid health risks. There is equipment damaged by heat and fire. There is trading lost while stores recover, the food-safety response and its effect on customer trust, and the work of investigating and restoring controllers across many sites.

Illustrative categories (ours), not from the reporting.

None of those numbers will come from a scan. They come from the store operations lead who knows what a freezer aisle holds, the refrigeration contractor who knows how long a unit takes to replace, and the finance team who know what a closed store costs per hour. That is structured expert judgement, and it can be done well or badly. Done well, it is written down, ranges rather than single guesses are used, and over time the people who estimate well are the ones whose numbers carry weight.

Time matters most. Cyber Daily, citing Reuters, reported that in about 150 affected Intermarché stores, refrigerators operated at 50 degrees for six hours. Pearce told the same publication of a separately reported incident involving Dixell equipment, where monitoring detected an abnormal temperature rise at about 4am, and store staff and refrigeration specialists stopped the attack before food had to be discarded. Same kind of asset, very different night. Detection time is the variable that moves the dollar figure, and a risk register that scores only likelihood has no place to put it.

The Australian version

Pearce was asked whether the same could happen here. He told Cyber Daily: "The same type of risk exists wherever refrigeration controls are connected for remote monitoring or maintenance". He added that the consequences could be sharper "in places with fewer supermarkets, longer resupply times or limited alternative cold storage". Anyone who has looked at a regional Australian supply map will recognise the scenario, and Pearce frames it as a resilience scenario to plan for rather than a prediction. Food and grocery is one of the eleven sectors in Australia's critical infrastructure framework. Whether a given retailer's network counts as a critical asset depends on declarations under the rules, but for operators that are covered this is a question the board may already be asking under another name.

The pattern is wider than refrigeration. Vanunu says the same advice applies to HVAC, building management systems and other operational infrastructure. Those are the systems that keep rooms cool, doors controlled and plant running at every kind of facility, including secure ones where the network is deliberately closed and nobody is going to point a scanner at it. They are also often old. We wrote about the retention decision in Managing Legacy Systems: Effective Strategies for Risk Reduction, and the questions there apply: if the controller cannot be patched or replaced this year, what is it costing you to keep it?

ASD's new Essentials framework, which we covered in Navigating the Transition to ASD Essentials, asks for evidence behind each area's rating. That is welcome, and it makes the point sharper. For an asset you cannot test, the honest rating is "asserted", and an asserted control still needs a dollar range beside it.

Five things to do this month

Find the controllers

List every refrigeration, HVAC and building-management controller, and every remote-management system that talks to them. Pearce's advice is to confirm what is installed across stores and distribution sites, who owns it, and whether any is end-of-life, unpatched or directly exposed to the internet.

Map who can reach them

Check that supplier and maintenance access is restricted to named, authorised users, strongly authenticated, time-limited and logged. Remote maintenance is a path into the estate, so treat the contractor's login as part of your attack surface.

Decide who gets the 2am alert

A setpoint changing outside an approved maintenance window should reach someone who can act, including overnight. Rehearse how the store team and the refrigeration provider confirm whether a reading is real and stop remote changes.

Write the one-path, one-night scenario

Estimate the loss if every site on a shared platform fails together, as a range, with the people who hold each part of the estimate in the room. Make time-to-detect an explicit input, and compare a six-hour night with a thirty-minute one.

Put it in the register as an asset

Give each controller class a named owner, a dollar range and an honest evidence label such as asserted, exercised or tested. A blank cell and a low rating are different statements; make sure yours says which one you mean.

The bottom line

Nothing about this incident, as reported, needed a sophisticated adversary. It needed an exposed management interface, an ageing controller and a shared path that nobody had counted as a single point of failure. The unusual part was the consequence: a cyber event whose loss showed up as spoiled stock, melted equipment and fires, in hundreds of stores on the same night.

We do not know yet who did it, how they got in, or how large the final bill will be, and a careful post should say so. We do know what the register would have said beforehand: a long list of small, separate, low numbers. The question for any Australian operator with refrigeration, HVAC or building controls is whether their own register would have said anything different.

The people who run your sites already know where the weak points are. They know which units are old, which contractor logs in remotely, and which stores would be hit hardest if resupply were slow. The job is to get that knowledge out of their heads and into a number your board can budget against.

A risk register that scores each fridge on its own will never see the night they all fail together.

Bring one asset you can't scan.

A refrigeration controller, a building management system, a plant room. We'll put a dollar range on it in 30 minutes, including the night they all fail together.

Book a 30-minute conversation → See the platform →

Sam Keogh
Founder & CEO, CyQuantiFi. 9 years at the Australian Department of Defence building risk quantification frameworks for classified systems. Founders Institute Sydney 2026.

Keep reading

cyber risk essentials

Navigating the Transition to ASD Essentials: Key Insights for Organizations

cyber pspf