From the night of 11 October 2026, attackers pushed temperatures in connected fridges and freezers at hundreds of French supermarkets as high as 50°C. Food was spoiled and several stores caught fire, according to Al Jazeera's AFP and Reuters-sourced report. The Paris prosecutor's office called it a "large-scale" attack on connected refrigerators. Prime Minister Sébastien Lecornu ordered ANSSI, the national cybersecurity agency, to investigate.
The incident is being read as a case for tougher IoT regulation. That reading deserves a fair hearing. It is also mostly wrong about where the failure sits.
The strongest case for more regulation
Supermarket refrigeration is critical infrastructure in practice, even if no statute calls it that. A cold chain failure destroys inventory within hours. Intermarché's chief executive told BFM TV that losses could reach "tens of millions of euros nationwide in a single day". Fire is a physical safety risk. Retailers buy these controllers as appliances, not as networked computers, and cannot audit firmware. The argument runs that only binding obligations on manufacturers will fix that asymmetry.
What is actually known
Reported store counts differ. Retailers told AFP that at least 300 Intermarché or Netto shops and more than 100 Coopérative U outlets were hit, and Carrefour reported 80. Reuters, as carried by TimesLIVE, put the Les Mousquetaires (Intermarché) figure at about 150 stores. Nobody has claimed responsibility, and I found no official ANSSI report on the incident.
What is public is the CERT-FR alert, which sits inside ANSSI. CERTFR-2026-ALE-012 was first published on 12 October and last updated on 16 October. It covers Danfoss AK-SC and AK-SM controllers and Copeland and Dixell xweb units. It warns that campaigns are probably still ongoing. Its remedies are mundane: remove public internet exposure, check defrost schedules, restore access only through a VPN or protected network, and apply vendor guidance, including setting the Danfoss security level to Strict and changing default passwords.
A source close to Lecornu said ANSSI had found a vulnerability in Danfoss software. Danfoss said the affected units were running outdated firmware and that it had long urged customers to update or migrate legacy systems. The CERT-FR recommendations I read do not name a specific CVE, so the exact entry point is not public. Treat the Danfoss account as the vendor's, not an established finding.
The flaws were already known
On 9 August 2026, Claroty's Team82 published research on the Danfoss AK-SM 800A. It described a hidden "code of the day" authentication bypass (CVE-2025-41450), an OS command injection leading to remote code execution (CVE-2025-41451), and a web-server configuration flaw (CVE-2025-41452). Firmware R4.3.1 addressed them. A Censys scan found 2,765 such devices exposed to the internet. The researchers did not link these CVEs to the October attack, and neither does the CERT-FR alert I read. They do show that a fix existed, that disclosure was coordinated, and that thousands of controllers still sat on the open internet.
The CERT-FR text is blunt about the harder problem. Leaving an end-of-life device with no security fixes exposed to the internet carries a "very high" risk of compromise. A factory reset removes existing persistence but leaves the device vulnerable, so it will probably be compromised again. No law can patch a product its vendor has stopped supporting.
Why the Cyber Resilience Act is the right tool, and why it is late
The EU has already legislated for manufacturers. Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA), requires a support period of at least five years, unless the product's expected use is shorter. It also requires an early warning to the coordinating CSIRT and ENISA within 24 hours of a manufacturer learning of an actively exploited vulnerability. The Commission's CRA page gives the timetable. The Act entered into force on 10 December 2024 and its reporting obligations apply from 11 September 2026. Its main obligations apply from 11 December 2027.
That timetable matters. The reporting duty has been live for only about a month, and the design, update and support duties arrive after this attack. Whether any of them would have reached controllers already installed in French stores is something I did not verify, and it is the question lawmakers should answer before drafting anything new.
A proportionate response
The pro-innovation instinct is to resist a second, French-specific IoT statute layered on the CRA and NIS2. Divergent national rules raise compliance costs for exactly the mid-sized hardware makers Europe wants to keep. Three narrower steps would do more.
- Enforce what exists. Give market surveillance authorities the resources to apply CRA reporting and support-period rules from day one.
- Fund exposure scanning. CERT-FR and national CSIRTs can notify operators of internet-facing controllers, as the Censys data shows is feasible. Notification is cheap and costs no innovation.
- Price in end-of-life. Procurement and insurance terms should require retailers to retire unsupported controllers or isolate them behind VPNs. The CERT-FR alert already advises checking insurance terms before cutting remote uplinks.
The case against heavier mandates is not that the risk is small. It is that the cheapest controls here are network segmentation and patching, which are operator decisions. A rule that punishes vendors for flaws they have already fixed, while the operators who skipped the fix face no consequence, misallocates responsibility.
What to watch
The measure of success will be how fast exposed controllers disappear from scans, not how many new articles a bill contains. If ANSSI publishes its findings, the questions to ask are simple. Which firmware was running, was the device end-of-life, and was it reachable from the public internet? Those answers will show whether the CRA's five-year support rule is enough or whether the gap is in what happens after support ends.