Most cyber losses are measured in downtime and records. This one is measured in yogurt, fish and frozen peas. That should worry boards more, not less.
Overnight from Oct 11 to Oct 12, attackers got into Danfoss refrigeration control systems in French supermarkets and triggered forced defrost cycles. Numerama reports the attackers set a 50°C setpoint and kept defrost running, so refrigerated cases ran like heaters for hours. Only older versions of the Danfoss software, before version 4, appear to be affected (Numerama).
The scale is real. Intermarché and Netto counted about 300 stores hit, and Coopérative U fewer than 100 (BFMTV). France Inter put Intermarché’s count at 200 to 300 out of roughly 3,600 stores, with two Alsace stores alone reporting €270,000 in lost goods (France Inter). Paris prosecutors opened an investigation and cited outbreaks of fire (AFP). Leclerc was reportedly hit too but didn’t confirm to AFP. Attribution: Undisclosed.
Why this attack is different. Nobody encrypted anything. Nobody asked for money. Attackers took a safety and maintenance function, defrost, and turned it into a weapon. That’s an integrity attack on a physical process. The controller did exactly what it was told. It was told the wrong thing.
That matters for detection. Your EDR won’t see it. There’s no malware on a laptop and no suspicious PowerShell. The only signal is a process value drifting: a setpoint changed, defrost running longer than any normal cycle, case temperatures climbing. If those alarms go to a facilities dashboard nobody watches at 2 a.m., you find out when the morning crew opens the doors.
Who owns this? In most retailers, not the CISO. Refrigeration and building controls usually sit with facilities, are installed and maintained by contractors, and often get remote access through whatever path the integrator set up years ago. They’re on the P&L as equipment, not on the security roadmap as assets. That ownership gap is the actual vulnerability here, more than any single bug.
Then the money. Intermarché warned AFP that some insurance policies may not cover this type of in-store incident (AFP). Think about why. A cyber policy is built around data, ransom and business interruption. A property policy covers spoiled stock from a power cut or a broken compressor, but often excludes losses caused by a cyber event. A remote attacker spoiling food can fall right in the gap. Every CFO with cold storage, pharma, or temperature-sensitive inventory should ask their broker this week which policy pays if a hacker changes a setpoint.
And it wasn’t the only grocer having a bad Monday. Ahold Delhaize said on Oct 12 it was dealing with a security issue in its network and took some systems offline as a precaution, while stores stayed open. It flagged the statement as inside information under EU market abuse rules (Ahold Delhaize). No link to the French attack has been reported. Still, two incidents at food retailers on the same night will put retail boards on alert.
What we’d do Monday morning.
Inventory every refrigeration controller, building management front end and HVAC supervisor. Get the vendor, model and software version for each. Anything on Danfoss software older than version 4 goes to the top of the list.
Take them off the direct internet. If a contractor needs remote access, route it through a gateway you control, with MFA and session logging. Kill any remote path you can’t name an owner for.
Alarm on the process, not the network. Setpoint changes, defrost cycles beyond normal duration and case temperature above threshold should page a human, not just turn a tile red.
Know your manual fallback. Can store staff override the controller and force cooling locally? If the answer is “call the vendor,” fix that first.
The read. OT security has spent years talking about power grids and water plants. This attack hit the long tail: thousands of small controllers in ordinary buildings, owned by nobody in security. That’s where the next wave of physical-impact attacks is cheapest to run.