The French Fridge Fiasco: What We Must Learn About IoT Security
So, who left the digital fridge door wide open?
Unless you’ve been entirely offline this week, you’ve likely seen the sensational headlines: malicious actors remotely hijacked French supermarket refrigeration systems, cranking the heat up to a sweltering 122°F overnight. The aftermath was chaotic. Tons of food were ruined, several locations had to contend with fires or indoor rain from triggered sprinklers, authorities in Paris launched a formal investigation, and the head of Coopérative U described the event as completely unprecedented. The Les Mousquetaires group alone is estimating damages in the millions of euros.
To be fair, a significant response is warranted. When hundreds of grocery stores are forced to throw out their entire fresh and frozen stock in a single morning, it’s a massive blow. Moreover, any disruption to the food supply chain inevitably attracts swift political scrutiny.
However, after sifting through the mainstream reporting and the initial technical analyses, the mechanics of the attack are far less exotic than the breathless news coverage implies. This is the exact same internet-exposed device vulnerability we in the security industry have been warning about for over ten years. The only difference is that this time, the consequences are highly visual. A dumpster overflowing with ruined frozen pizzas generates far more media traction than a dry CVE (Common Vulnerabilities and Exposures) bulletin ever could.
The Reality Behind the Headlines: A Classic IoT Blunder
The compromised devices were not the smart refrigerators you might have in your kitchen. They were industrial supervisory controllers—the central nervous system that grocery stores rely on to manage every display case, walk-in freezer, and cold storage room from a single interface. The initial attacks targeted Danfoss AK-SM and AK-SC units, and by Tuesday, an advisory from the French government (CERTFR-2026-ALE-012) confirmed that Copeland and Dixell XWEB systems were also affected.
These systems are designed for remote access so that HVAC and refrigeration contractors can log in, tweak temperature settings, and monitor alarms without needing to dispatch a technician to the physical store. From a business perspective, this makes perfect sense. The fatal flaw was how these systems were connected.
Security researchers have been sounding the alarm about these controllers being left naked on the public internet for quite some time. In August, Claroty’s Team82 released research specifically on the Danfoss AK-SM 800A (even presenting their findings at DEF CON), identifying roughly 2,765 exposed units globally. Crucially, France reportedly houses nearly 60% of all internet-facing Danfoss controllers, which largely explains why the country bore the brunt of this specific attack.
Team82’s research also uncovered a hidden, hardcoded login mechanism on the 800A that accepted a daily generated code based simply on the current date (CVE-2025-41450, which was patched in version R4.2). This is the source of the “the password was just today’s date” narrative floating around social media. However, the truth is far more concerning than a user setting a weak password. Because this was a hardcoded backdoor, even a perfectly complex administrator password would not have stopped an attacker. Furthermore, short of updating the firmware, there was nothing a system operator could do to secure it.
According to Danfoss, the vast majority of the breached systems were older, legacy models running obsolete firmware—some of which had reached their end-of-life years ago—and harboring known vulnerabilities that have been public since 2023. Additionally, some units were connected via cellular 3G modems for remote monitoring, and attackers reportedly located them using the Shodan search engine. What remains unconfirmed is the exact initial access vector; whether they exploited the date-code backdoor, a separate vulnerability, or simply guessed default credentials is still unknown. Therefore, any claims of knowing the precise exploit chain should be treated with skepticism.
Once inside, the attackers didn’t even need to deploy custom malware. They simply weaponized the controllers’ legitimate, built-in features. They forced the units into an endless defrost cycle targeting 50°C (122°F). In some cold rooms, they extended the standard one-hour defrost window to eight hours—a move that Le Monde noted was likely intended to suppress the temperature alarms that would normally trigger. The perpetrators clearly understood commercial refrigeration systems and used the technology exactly as it was designed, albeit with malicious intent. As of now, no group has claimed responsibility for the sabotage.
The Deeper Lesson Beyond Grocery Stores
If you remove the “grocery store” context, the underlying vulnerabilities should make any cybersecurity professional incredibly uncomfortable.
If you ask a supermarket chain who is responsible for the refrigeration controller, the answer is rarely the IT or Security team. It’s usually the Facilities department, or more accurately, a third-party refrigeration contractor that Facilities hired a decade ago. These controllers frequently do not exist on any inventory managed by the security team. When regulators discuss incident response, maintaining accurate asset inventories and establishing clear lines of responsibility among retailers, hardware manufacturers, and maintenance providers are always prioritized. If you don’t know what devices are on your network or who they communicate with, you will only learn about an exposed controller when an attacker exploits it.
Once a hidden device is discovered, the next issue is how external parties access it. The most common answer is also the most negligent: the contractor needed remote access, so someone simply opened a port on the firewall or slapped a cellular modem directly onto the control panel, and the matter was closed. The French government was unambiguous in their assessment: exposing a critical management interface to the open internet violates basic security best practices. If remote administration is truly unavoidable, it must be strictly limited to trusted, specific IP addresses.
I would argue we need to go even further. Access for third-party vendors must be tied to a specific, named individual, heavily authenticated, granted only for the duration of the required session, meticulously logged, and completely inaccessible from the outside at all other times. The discovery of the hardcoded date-code backdoor proves this point perfectly: when you cannot trust the device’s internal authentication mechanisms, the only effective control is strictly limiting who can reach the login prompt in the first place.
“Even with access locked down, detection has its own headache here, because every action in this attack was a valid command. No signature fires on ‘run defrost,’ because running defrost is what the thing does several times a day.”
The only way to detect an attack utilizing legitimate commands is to understand the baseline normal behavior for that specific device: who typically logs in, from where, and at what time. A controller that normally sees a brief login from a specific contractor twice a month suddenly accepting simultaneous logins at 2:00 AM across hundreds of locations is a massive anomaly—but only if someone is actually monitoring the logs.
This Was Never Just a Supermarket Problem
If you are reading this from an office building, a hospital, a university, or a data center and feeling relieved that you dodged a bullet, think again. Every modern facility has its own equivalent of a refrigeration controller: HVAC systems, building management software, badge readers, security cameras, Uninterruptible Power Supplies (UPS), and environmental sensors that were often installed by Facilities without ever notifying IT.
The vast majority of these systems were purchased by non-security personnel, installed by third-party contractors, and configured solely for the convenience of those contractors. Much of this equipment is running on firmware that hasn’t been updated since the day it was powered on.
It’s also important to acknowledge the limitations of network-based security controls. A control panel utilizing its own dedicated 3G modem bypasses your corporate network entirely. No firewall or intrusion detection system on your network will ever see it, let alone block malicious traffic. The only defense against this is strict policy enforcement and physical legwork: directly asking your vendors if they use out-of-band access, and physically inspecting the hardware to see what is plugged in. It’s tedious, unglamorous work, but this is exactly the blind spot the attackers exploited in several of the French supermarkets.
I have personally encountered this exact scenario. Years ago, I was tasked with building a security program from scratch, which included extensive asset discovery, particularly for newly acquired companies. Every sweep uncovered devices that were not on any official inventory—sometimes a single forgotten appliance, sometimes an entire rack of equipment. It wasn’t malicious concealment; hardware simply outlasts the institutional memory of the people who installed it.
During one of these audits, we had exhaustively scanned the network. Standard discovery scans found nothing, and even advanced techniques like analyzing ARP neighbor tables on the switches to find silent devices came up empty. Then, during a physical site walk-through, someone looked into a server closet, noticed a small, dusty box with an antenna resting on top of a cabinet, and asked the dreaded question: “What is this?”
It was a cellular remote access modem installed years prior for a vendor or project that no one could even remember, and it had never been decommissioned. It was absent from all asset records, it bypassed all our network monitoring, and it had potentially been maintaining a live connection to the internet for years. Our digital tools insisted the site was secure, but the vulnerability was only discovered because someone physically opened a door.
Actionable Steps to Secure Your IoT Footprint Today
If you want to prevent a similar disaster, here is what you need to do immediately:
- Scan Your Perimeter: Run your public IP ranges through Shodan or Censys today. The attackers already have. If you find any management interfaces exposed that shouldn’t be, take them offline immediately.
- Conduct an Internal Audit: Locate every IoT and Operational Technology (OT) device on your internal network. Identify what it is and who is responsible for it. This is challenging, as many devices lazily identify themselves merely as a “Linux device,” but it is crucial.
- Implement Network Segmentation: Once you identify your devices, isolate them so they can only communicate with the systems they absolutely need to. A refrigeration controller only needs to talk to its central management server and the vendor’s secure access gateway; it should never be accessible from the guest Wi-Fi or a random workstation on the corporate VLAN.
- Revoke “Always-On” Vendor Access: Eliminate open ports dedicated to contractors. Replace them with access that is granted on a per-person, per-session basis.
- Interrogate Your Vendors: Ask every facilities and maintenance vendor, in writing, if any of their installed equipment utilizes cellular modems or out-of-band access methods.
- Lifecycle Management: Patch everything you can. If a device is end-of-life and cannot be updated, either retire it or isolate it so aggressively on the network that its vulnerabilities cannot be exploited.
This is the core of modern network security: knowing exactly what is plugged into your infrastructure, fingerprinting devices accurately enough to distinguish a critical controller from a networked printer, and enforcing access control based on identity and device type rather than just physical port connection.
These steps wouldn’t have completely nullified the French supermarket attacks on their own, but they would have drastically reduced the attack surface and ensured that those anomalous 2:00 AM logins triggered an alert that a human analyst would actually see.
Right now, somewhere in your environment, a third-party contractor likely has login credentials to a device you don’t even know exists. It is far better that you find it before someone armed with Shodan and malicious intent does.
