On the night of October 11, 2026, cyber attackers pushed refrigeration controllers in hundreds of French supermarkets into defrost mode, heating cooling units to 50°C, triggering fires in some cases, and forcing stores to dump their fresh and frozen inventory. More than 400 stores across Carrefour, Intermarché, Netto, Monoprix, Leclerc, and Coopérative U were hit. Losses are expected to reach several million euros. The common thread: Danfoss refrigeration controllers, made by a Danish industrial company, whose web dashboards were sitting on the open internet like unlocked doors. IPinfo's weekly internet scans paint a damning picture of the exposure that preceded the attack. Five days before the incident, 2,528 Danfoss StoreView dashboards were publicly accessible worldwide — the equivalent of a back-room control panel anyone could open by typing in the address. France accounted for 1,331 of them, 53%, more than the other 72 countries and territories combined. Poland was a distant second at 179, followed by the United States at 101. The software running these dashboards was overwhelmingly outdated. Of France's 1,331 exposed systems, 85% ran software with known security flaws — a figure almost identical to the 84% elsewhere. That breaks down to 527 older controllers Danfoss declared end-of-life in 2023 (the same year a security firm published a login bypass for them), 280 missing critical 2023 fixes, and 329 missing 2025 fixes. Only 195 had every known patch applied. France didn't patch worse than anyone else — it simply had far more systems exposed. The exposure was not a brief window. Every weekly scan from late March 2026 through the attack found roughly the same count: between 2,464 and 2,622 dashboards open worldwide, about half in France. Of the 1,331 French dashboards found on October 6, 1,019 were at the same address six months earlier. The count of end-of-life controllers in France actually ticked up slightly over that period, from 519 to 527. The share of newer controllers with all fixes applied crept from 14% to 24% — under two percentage points per month. The institutional incentives are revealing. CERT-FR's own advisory hints at why stores kept these systems online: it tells operators to check their insurance terms before cutting the data their controllers send to refrigeration contractors. Coopérative U's CEO confirmed stores don't buy from Danfoss directly but use systems supplied by refrigeration contractors — a supply chain where nobody owns the security obligation. The controllers sit on store internet connections, 98% on telecom networks rather than data centers, with access opened for remote technicians. After the attack, the response was rapid but reactive. By October 14, only 316 of the 1,331 French dashboards remained online — a 76% drop, compared to the normal weekly churn of 3-7%. End-of-life controllers dropped from 527 to 64. But even fully patched systems were disconnected, suggesting stores chose the blunt instrument of pulling the plug rather than the scalpel of proper network segmentation. Outside France, 25% of dashboards disappeared, above the usual 9-12%. CERT-FR expanded its alert to include XWEB supervisors from Copeland and Dixell, noting that attack campaigns were probably still ongoing. The investigation by the Paris prosecutor's office remains open. Nobody has publicly attributed the attack or identified the exact entry method. But the forensic picture is clear enough: a massive, months-long exposure of industrial control systems on the public internet, a patchwork of end-of-life hardware and unpatched firmware, a supply chain where security responsibility dissolved between manufacturers, contractors, and retailers, and the predictable result when someone decided to exploit it.
