On the night of October 11 to 12, attackers reached into the refrigeration controllers of supermarkets across France and switched on the defrost cycle. Fridges and freezers climbed to around 50°C (122°F). Stock was thrown away, and Reuters photo coverage reported fires at several stores. The Paris prosecutor's office puts the number of victims at around 700.
Three weeks later, overnight into Monday, November 2, it happened again. More than 50 stores in Belgium, a limited number of smaller stores in Sweden, and over a dozen more across Ireland, Estonia, the Netherlands and Luxembourg. Carrefour said 15 of its roughly 700 Belgian stores were affected. Retailers described the same method and the same result.
The second wave carries a warning for every chief information security officer (CISO) responsible for physical systems, whether or not they work in retail. The weeks after a public attack are when a target is most exposed: like a second strike to a nerve that is already sensitized, the same technique hits hardest wherever the damage from the first has not yet been dealt with. Figures from one Belgian installer suggest that operators who secured their controllers between the two waves largely avoided the second one. The rest of this post covers what to do now, what is known so far, and why I have seen this pattern before.
Five Things to Do Before the Third Attack
1. Find them. Inventory internet-reachable building and operational controllers. Use external attack surface data and ask facilities and every maintenance contractor directly. Expect the second list to be longer than the first.
2. Check support status. For each controller, record the vendor's end-of-service date. Anything past it is an accepted risk that a named executive should sign, not a default.
3. Remove remote write by default. Let telemetry and alarms flow out. Make setpoint and mode changes require on-site action or brokered, time-limited access protected by multi-factor authentication.
4. Govern contractor access as identity. Named accounts, an owner for each, expiry dates, session logging. Treat installer credentials as privileged non-human access and manage them with the same controls you apply to service accounts.
5. Plan for the physical consequence. Independent high-temperature alarms that do not depend on the controller being trustworthy, a manual fallback, and a clear answer to who gets called at 2 a.m.
Beyond these five steps, treat the weeks after any public campaign against equipment you run as a period of heightened threat, when attackers and copycats know what to look for, and your teams are still focused on recovery.
Why This Is Your Problem, Not Only Retail's
If you run security for a bank, an insurer, a manufacturer or a hospital, it is tempting to file this under someone else's sector, but the same class of equipment is almost certainly running in your own buildings.
Most enterprises run equipment with the same profile: heating, ventilation and air conditioning (HVAC) and cooling for server rooms, cold storage in labs and pharmacy, building management systems, physical access control. These systems are commonly bought by facilities, installed and maintained remotely by a contractor, missing from the asset inventory, and outside vulnerability scanning. The supermarket incidents show what a compromised controller costs when the consequence is physical: the loss is measured in spoiled stock, closed stores and fire risk rather than in leaked records.
Regulation offers little cover for the equipment already in service. The EU Cyber Resilience Act will require manufacturers to provide a support period reflecting a product's expected lifetime from December 2027. Until then, as The Record notes, there is no legal obligation on manufacturers to fix the products targeted in these attacks, and even after that date the requirements will apply only to devices placed on the market from then on, not to discontinued controllers already installed in stores. And as the Danfoss example below shows, the approach of that regulation can shorten vendor support for legacy equipment rather than extend it.
What Is Known, and What Is Not
Method. In both waves, attackers triggered the controllers' built-in defrost mode and overrode the temperature and duration settings, according to retailer and installer accounts reported by Tom's Hardware and Belga.
Equipment. A French official update relayed by INCIBE-CERT, the incident response team of Spain's National Cybersecurity Institute, named Danfoss, Copeland and Dixell controllers among those compromised in October. In the November wave, an Estonian contractor said an older Danfoss system was accessed, and Dutch broadcaster NOS reported that Copeland equipment was targeted in Belgium.
Support status. After the French attack, both Danfoss and Copeland said the affected devices were mainly discontinued products that no longer received security updates. Danfoss had announced a hard end-of-service policy for legacy products in an October 2025 newsletter, citing recent European cybersecurity legislation and saying that continued support would bring new legal obligations to maintain security updates.
Warning time. Claroty's Team82 published research in August 2026 warning that these units were at risk of remote compromise.
Precedent. The same Danfoss newsletter referenced earlier campaigns against its controllers, including attacks on Russian supermarkets at the start of the invasion of Ukraine and around 40 stores in Israel that Danfoss said lacked adequate firewall or virtual private network (VPN) protection.
Remediation gap. Belgian installer Sabcobel said it knew of around 20 affected units out of the hundreds it manages, that the affected units needed physical modifications rather than a software update alone, and that most of its customers had moved units onto a secure connection after the French attack. Most, however, is not all, and the units that had not been moved are the likeliest explanation for the second wave's Belgian victims.
Unknown. Who is responsible, whether the two waves are linked, and the initial access route in each case.
The Identity Question Underneath
Every controller that can be changed remotely is an access path with an identity behind it: an installer account, a vendor portal login, a shared service credential, an always-on VPN tunnel. These usually sit outside identity and access management (IAM) and privileged access management (PAM) programs, and they rarely appear in quarterly access certifications.
The public reporting so far points toward internet-exposed, unsupported devices rather than stolen credentials, although the initial access route in each wave remains unconfirmed. Whichever it turns out to be, the question every CISO should be able to answer is the same: who and what can change a setpoint on our physical systems from outside the building, and how would we know if they did?
Why the Second Strike Does More Damage
Anyone who has trained in kickboxing knows the low kick to the outside of the thigh. The first one hurts. The second, landing on tissue that is already inflamed and on a nerve that is already sensitized, can take the leg away. The attacker needs no extra power the second time, only the same strike in the same place before the target has recovered.
October was the first kick. It showed which controllers were exposed, which operators and installers were slow to move, and how the sector and its suppliers would respond in public. No group has claimed either wave, and it is not known whether the same people carried out both. For defenders, that distinction matters less than it might seem, because the method was public, the device types were named in the press, and the remaining exposed targets were findable.
Twice in One Weekend
Earlier in my career I was part of the incident response team (not because I was special, but because I was local) when Sun Microsystems' European data center at Bagshot Manor was raided, and then raided again, in the same weekend. In the 1990s, gangs were stealing high-end computing gear, so Sun was a juicy target. The first raid on a Friday evening cleaned out the server farm, resulting in heroic activities by my colleagues in finding machines that could be redeployed, recovering from (offsite!) backups, and bringing core services back online.
The second raid on a Sunday evening was worse, and as one colleague said, "This one was personal." The same gang came back, rammed a vehicle through the damaged wall again, and took the backups that we had painstakingly brought back from offsite storage for the recovery. (And for those of you wondering what happened next, we took a lot of desktop machines and used those until emergency replacements were flown in.)
What stays with me is the second break-in rather than the first: first incidents are expected, and response plans are written for them, but the second landed while we were still in response mode. Whoever came back already knew the layout, knew what was worth taking, and knew our attention was on recovery and reporting rather than on the attack.
Europe's grocers have just lived through the same pattern, and the responsibility now sits with you: find the controllers you own, close the remote paths into them, and assume that anyone who studied the first two waves already knows where to look.
