What Happened

Hundreds of supermarkets in France were affected by cyberattacks targeting remote management systems used for refrigeration and freezer installations. Attackers gained access to controllers responsible for temperature management and, in some locations, changed settings to approximately 50°C. The consequences included spoiled food, operational disruption and, in some cases, fires.

Affected retailers included Intermarché, Carrefour, Monoprix and Coopérative U. France’s CERT-FR confirmed multiple compromises involving refrigeration management systems from Danfoss, Copeland and Dixell.

The incident matters well beyond retail. It demonstrates how compromising connected technical equipment can turn a digital security incident into physical and operational impact.

The Vulnerability Is Only Part of the Problem

CERT-FR highlights a fundamental issue: management interfaces for some of these systems were directly exposed to the internet. This means equipment controlling physical processes could be reached externally without sufficient network restrictions.

Outdated firmware and end-of-life equipment create an additional problem in some environments. In these cases, even a factory reset may not solve the underlying risk. It can remove persistence from the current compromise, but if the device remains internet-facing and vulnerable, it can be compromised again.

When Digital Risk Becomes Physical Risk

The incident illustrates why Operational Technology security cannot be treated purely as an IT issue.

OT systems control real-world processes such as:

• temperature;

• manufacturing;

• power;

• water;

• logistics;

• warehouse operations;

• building and facility automation.

When these systems are compromised, the impact can become physical.

For supermarkets, that means destroyed goods and interrupted operations. In manufacturing, a similar compromise could stop a production line.

In energy or water environments, it could affect critical services.

Internet Exposure of Technical Equipment Should Be the Exception

One of CERT-FR’s clearest recommendations is to remove direct internet exposure from affected devices.

Where remote management is required, access should be provided through a protected connection and restricted to the systems and users that genuinely require it.

Organizations should review:

• technical controllers exposed through public IP addresses;

• devices still using default or weak passwords;

• equipment no longer receiving security updates;

• access granted to external maintenance providers;

• remote administration interfaces;

• segmentation between corporate and operational networks;

• logging and monitoring of administrative activity;

• unusual changes to technical configurations.

Restoring the Device Is Not Enough

For suspected compromise, CERT-FR recommends isolating affected equipment, performing a factory reset, applying available security updates, rotating credentials and reconfiguring the device before returning it to service.

There is, however, an important distinction between removing the compromise and removing the condition that enabled it.

If the device is placed back online with the same vulnerable configuration, the exposure remains.

For end-of-life equipment where security fixes are no longer available, organizations need to consider compensating controls or replacement.

What Organizations Should Review

The incident provides a useful reason for any organization operating industrial or technical systems to inventory its externally exposed equipment.

Practical questions include:

• which OT and IoT devices are reachable from the internet;

• why that exposure is required;

• whether secure channels are used for remote administration;

• whether default credentials have been replaced;

• whether equipment still receives security updates;

• whether end-of-life devices remain in operation;

• whether operational networks are segmented from corporate IT;

• whether abnormal administrative activity is monitored;

• whether an incident response process exists for compromised technical equipment;

• whether the physical process can remain safe if remote management is lost.

DIAMATIX Comment

This incident illustrates how connecting physical systems to the internet changes their risk profile. A device that was once a local technical component becomes an externally reachable part of the digital environment. That requires the same discipline applied to servers, cloud services and user identities: access control, patching, monitoring and clear ownership.

Visibility is particularly important. Organizations need to know more than whether a controller exists.

They need to know: Is it externally accessible, who manages it, how is it updated, and how would we detect abnormal behavior?

In OT environments, a cybersecurity incident can move very quickly from a digital issue to an operational loss.

Practical Takeaway

The incidents affecting French supermarkets illustrate a simple dependency: the more physical processes depend on connected systems, the more important the security of the underlying technical equipment becomes.

Cybersecurity no longer protects only data and identities. In many environments, it also protects the physical process itself.

Review which technical systems in your environment are exposed to the internet and whether that access is genuinely required and adequately protected.

Contact DIAMATIX

Sources

• CERT-FR. Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération, CERTFR-2026-ALE-012, 12–13 October 2026.

• Reuters. Hackers heat French supermarket fridges, sparking fires and spoiling food, 12 October 2026.

• Reuters. Copeland, Dixell refrigeration systems also hacked, French cybersecurity agency says, 13 October 2026.

• Reuters. Cyberattack affected 80 stores of French supermarket chain Co-Operative U, 13 October 2026.