What happened
Overnight on 11–12 October 2026, attackers remotely raised the temperature of refrigeration equipment at French supermarkets. BleepingComputer reported that the victims included Intermarché, Coopérative U, Carrefour Market, Monoprix and Leclerc, and that French outlets put the number of stores affected at 250 to 350. Al Jazeera reported a higher figure of more than 500 shops, with temperatures pushed as high as 50°C, some fires and melted equipment, and millions of euros of spoiled food. The counts differ and the attacker is unidentified. The Paris prosecutor's office has opened an investigation.
The affected controllers were made by Danfoss. BleepingComputer reports the attackers appeared to trigger the units' built-in forced-defrost function on devices running older software. Danfoss told reporters that most affected units were legacy products with outdated firmware. How the devices were compromised has not been publicly confirmed.
The flaws were public for well over a year
The vulnerabilities reportedly involved, CVE-2025-41450 and CVE-2025-41451, are not new. The U.S. cybersecurity agency CISA's advisory ICSA-25-140-03 was first published on 20 May 2025 and updated on 26 August 2025. It describes an authentication bypass in the Danfoss AK-SM 8xxA series, caused by datetime-based password generation and fixed in release R4.2. It also describes a command injection that allows post-authentication remote code execution, fixed in R4.3.1. The advisory tells operators to keep control systems off the internet and behind firewalls or VPNs.
BleepingComputer cites a researcher who found 2,752 Danfoss systems exposed online on the Monday after the attack, 1,590 of them in France. A patch existed for roughly seventeen months, and the devices were still reachable from the public internet. No law or fine was needed to make either safeguard available. Both went unused.
The strongest case for tougher mandates
The argument for aggressive regulation is serious. Cold chains are critical infrastructure in practice: spoiled food is a public-health and supply problem, not just a retailer's loss. Retailers have thin margins and little reason to prioritise firmware on equipment that has run for years. If voluntary advisories were enough, this attack would not have worked. Advocates would add that an advisory published in May 2025 plainly did not reach the people who operate these machines.
Why bans and blunt mandates are the wrong answer
The lesson is not that internet-connected industrial equipment should be restricted, or that every retailer should face prescriptive technical audits. Remote monitoring of refrigeration saves energy, catches real equipment failures and reduces food waste. A rule against connectivity would give up those benefits, and would likely push operators toward unmanaged workarounds.
The failure here sits in two specific places, and proportionate rules can target both.
- Manufacturer lifecycle duties. Operators cannot patch what the vendor does not make easy to patch. The EU's Cyber Resilience Act entered into force on 10 December 2024. Its vulnerability-reporting obligations for actively exploited flaws began on 11 September 2026, one month before this attack, and its main obligations apply from 11 December 2027. It places vulnerability handling on manufacturers over a product's lifecycle. That is the right place for the duty, because the manufacturer controls the update channel.
- Exposure hygiene as a baseline. Putting a management interface on the open internet should be treated as a recognised failure in any sectoral security guidance. The fix is cheap: a VPN or an access allowlist.
The gap the Cyber Resilience Act does not close
The Cyber Resilience Act largely looks forward. Its main obligations apply from December 2027, and legacy units installed years ago, like those Danfoss described, fall largely outside its design-stage requirements. This incident therefore falls in the transition period. Regulators should not respond by stretching the law retroactively. Retroactive duties on installed equipment would be legally fragile and would hit small operators hardest.
A better approach has three parts:
- Have France's national cybersecurity agency and sector bodies push targeted notices to operators of known-vulnerable, internet-exposed devices. Exposure scanning already exists and is cheap. The French agency has already advised disconnecting or restricting access to the freezers and installing updates, but that guidance came after the damage.
- Press manufacturers to publish clear end-of-support dates, and to ship update paths that a store technician can use without a vendor visit.
- Keep criminal enforcement focused on attackers. The Paris investigation is the right tool for that; fining victims for being hacked adds little deterrence and discourages disclosure.
What to watch
Two questions will decide whether this becomes a policy turning point. First, whether investigators confirm that the 2025 flaws were the actual entry point, since public reporting says only that the attack "reportedly" targeted these controllers. Second, whether the attackers were criminals, hacktivists or a state actor. A state-linked finding would invite sweeping national-security responses, so the evidence should come before the rules. If the reports hold, the Danfoss case shows that known flaws, patches that existed and exposure that could be avoided were enough. Policy that makes patches easy to ship and exposure unusual will address this better than new bans.