When Hackers Can Heat Refrigerators to 50°C, Cybersecurity Becomes a Physical-World Threat

The cyberattack affecting hundreds of French supermarkets demonstrates how cybersecurity threats are increasingly moving beyond data theft and ransomware into the physical systems that businesses depend upon. Attackers reportedly gained unauthorized control of Danfoss refrigeration management systems, remotely activating defrosting functions and raising temperatures to as much as 50°C. The resulting disruption forced affected stores to discard refrigerated products, with industry representatives estimating potential losses running into tens of millions of euros.

What makes this incident particularly concerning is that attackers manipulated legitimate equipment functionality rather than simply disabling systems. Refrigeration controllers designed to maintain safe operating temperatures became instruments of operational disruption. This demonstrates how a compromised operational technology (OT) device can directly affect product safety, business continuity and financial performance.

Another significant concern is the continued dependence on legacy infrastructure. Several affected controllers, including the Danfoss AK-SM 800 and AK-SC 355, are no longer supported with security updates, while some newer AK-SM 800A controllers reportedly operated outdated firmware. Such environments present difficult security challenges because replacing operational equipment can be expensive and disruptive, while leaving unsupported systems connected creates persistent exposure.

The incident also highlights the security implications of third-party remote maintenance. Retailers frequently depend on external service providers to manage refrigeration, HVAC and other connected equipment. Without strong access controls, network segmentation and continuous monitoring, these trusted management relationships can become potential avenues for compromise.

For enterprises, protecting operational technology requires more than conventional IT security controls. Organizations must identify connected assets, eliminate unnecessary internet exposure, restrict remote administration, isolate critical controllers and monitor abnormal network communications. Independent operational safeguards, including temperature monitoring and emergency response procedures, are equally essential.

The broader lesson is that cybersecurity is no longer concerned only with protecting information. It is increasingly responsible for protecting the physical processes that sustain everyday business operations.

When a cyberattack can turn refrigeration equipment into a source of financial loss and operational disruption, securing connected infrastructure becomes a fundamental business necessity rather than merely an IT responsibility.

Attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing stores to throw food away, several retail chains said. The attackers reached them through the controller that runs all of a store's fridges and freezers, a device made by Danish company Danfoss that maintenance firms can manage remotely. Les Mousquetaires

Source: Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers via The Hacker News — published 13 Oct 2026.