Who can switch off the equipment your business runs on?
Think about the equipment your business depends on that is not a computer. The cold room. The heating and air conditioning. The alarm panel, the camera recorder, the compressor on the production line, the machine that prints the labels. Most of it was installed by a specialist, and a lot of it has a small web page for managing it, so the engineer can check on it from their office instead of driving out.
Now the question nobody in your business is probably responsible for: can anyone else reach that page?
On the night of 11 October, somebody reached hundreds of them in France.
What happened
Supermarket freezers in roughly 400 French stores were remotely switched into defrost and held there. Intermarché said its units sat at 50°C for six hours and it threw all the affected food away. Managers opening up on Monday morning were met by hot air from the freezer aisles, and some stores had small fires. Two shops in Alsace alone reported losses of €270,000 between them. Carrefour, Coopérative U, Monoprix, and E.Leclerc were also hit, and Intermarché urgently disconnected another 100 stores from the internet to stop it spreading.
The target was the refrigeration controller: the box that runs every fridge and freezer in a store, made in most cases by the Danish firm Danfoss. Intermarché's owner said the systems were managed by Danfoss, not by the stores themselves. France's national computer emergency response team later added controllers from a second maker, Dixell, to its list of affected systems.
Danfoss says most of the units hit were older models it stopped updating years ago: one reached end of life in 2021, another was phased out in 2016. Some current models were also hit, running out-of-date software. Researchers at Claroty had published weaknesses in these controllers in 2025, and showed that a compromised controller could switch off cooling while still reporting normal temperatures to staff. Nobody has yet confirmed exactly how the attackers got in.
Why this is not a supermarket story
Strip away the fridges and three things made this possible. None of them are specific to food retail.
The kit was on the open internet for the supplier's convenience. Remote access lets an engineer troubleshoot without a site visit, which genuinely saves money. Supermarkets also have food safety rules to meet, which require timestamped temperature records. Both are good reasons to connect a controller. Neither is a reason to leave its management page open to anyone who finds it.
Nobody inside the business owned it. It was installed by a specialist and maintained by a supplier. The IT team, if there was one, probably never knew it had a web page.
It had outlived its updates. The controllers kept working perfectly as fridges long after they stopped being fixed as computers.
The most telling detail came afterwards. The internet scanning firm Censys counted 1,825 of these control panels openly reachable in France on the day of the attack. Three days later there were 537, a 71% drop. Censys says the data shows operators were not patching them. They were simply unplugging them from the internet. As its researchers put it, "there is no reason these should be directly connected to the Internet." Most of those businesses did not need the exposure at all. They just had not looked.
What to do this month
Make a list. Walk round the building with whoever handles facilities and ask of every piece of kit: does this have a network cable, a SIM card, or a Wi-Fi connection? Refrigeration, heating and ventilation, building management, door access, cameras, alarm panels, and anything on a production line. Write down who installed it and who maintains it.
Ask each supplier four questions. How do you connect to it remotely? Is its management page reachable from the open internet, or only through a connection we control? Is it still getting software updates, and when do they stop? Who has the login, and is it unique to our site?
Get it off the open internet. Remote support can still work. It just needs to come through a door you control, such as a virtual private network (an encrypted tunnel that only approved devices can use) or a remote access tool you switch on when the engineer needs it. The French authorities' first advice to operators was exactly this: disconnect the controllers or restrict who can reach them. Limiting access to your supplier's own network addresses is a reasonable first step while you sort out something better.
Plan for the box lying to you. Claroty showed a compromised controller can report normal temperatures while cooling is off. If losing that equipment overnight would cost you serious money, ask whether you have an alarm or check that does not depend on the same controller. Then check what your insurance says about stock lost to a deliberate attack on equipment, rather than to a breakdown.
If you are the director rather than the person doing the walk-round, one question covers it: "What on our premises can a supplier reach over the internet, and could a stranger reach it too?" If nobody can answer, that is the finding.
How Steelwise can help
Finding the connected equipment nobody owns, and working out which suppliers can reach it and how, is a short, well-defined review. Get in touch if you would like a second pair of eyes on yours.
Further reading
- CERT-FR alert on the Danfoss controller compromises (in French)
- Censys: Danfoss StoreView internet exposure report
- NCSC guidance on supply chain security