Summary
- An unidentified attacker compromised thousands of remotely managed refrigeration systems across hundreds of French grocery stores, driving up temperatures, spoiling stock and reportedly causing fires. Attribution remains unknown.
- The incident fits a wider pattern: ransomware and extortion crews are increasingly hitting building automation systems (BAS) — HVAC, door locks, badge readers, fire panels — because physical disruption raises pressure on executives to pay.
- Armis Labs (ServiceNow) reports that 73 percent of organisations run BAS of a kind already used in ransomware attacks, the same share have known exploited vulnerabilities in at least one BAS, and 91 percent of BAS traffic uses insecure protocols.
- Dragos data shows ransomware against industrial organisations rising every year since 2022, reaching 1,140 incidents in Q2 2026 alone.
- Visibility is the core gap: Dragos estimates fewer than 10 percent of OT networks worldwide have adequate monitoring.
What happened
According to The Register, the French supermarket attack took place late on a Sunday night and targeted internet-connected refrigeration controllers rather than corporate IT. No group has claimed responsibility, and it is not yet clear how access was gained, though one expert quoted pointed to internet exposure and unpatched firmware as the likely route.
It is the latest in a string of incidents where the damage was physical rather than purely digital. In August, a ransomware attack on a Canadian hospital disrupted its building management systems, affecting door access, central HVAC monitoring and the issuing of staff access cards. The 2023 Las Vegas casino intrusions similarly knocked out slot machines, payment kiosks and electronic room keys.
Physical disruption as extortion leverage
Tim Beasley, a senior incident response consultant at Semperis, described a case in which a victim refused to pay and the attacker responded by locking staff out of the offices. Police ultimately had to break windows to get the customer back into the building. Beasley said the customer did not pay.
Armis Labs’ report argues that modern BAS sit at the intersection of IT and OT, creating exposure that traditional IT controls do not cover. These systems typically demand continuous uptime, which makes them harder to patch, scan or take offline — and therefore attractive both to financially motivated crews and to state-backed or hacktivist actors seeking maximum disruption.
BAS as a hiding place
Michael Freeman, senior director of threat research at ServiceNow, told The Register that building management systems are easier for attackers to compromise and easier to hide in. He described an intrusion at a large financial institution where attackers who were repeatedly evicted from the IT network planted backdoors in the BMS to maintain persistent access, then pivoted back into IT.
Freeman also said attackers are now using AI to understand obscure building and industrial platforms, including those running VxWorks and older Unix variants. The effect is to erode the security-through-obscurity that has historically protected OT: attackers no longer need deep domain expertise to work out what changing a given setting will do.
The numbers keep climbing
Dragos, which tracks leak-site claims and disclosed intrusions against industrial organisations, reports a steady rise. Leak-site claims are not always accurate and do not necessarily mean control systems were affected, but the trend is consistent:
- 2023: 995 ransomware attacks on industrial organisations, up 49.5 percent on 2022.
- 2024: attacks up more than 87 percent; active groups targeting industrial organisations grew from 50 to 80.
- 2025: 119 ransomware groups affecting more than 3,300 industrial organisations.
- 2026: 1,020 incidents in Q1 and 1,140 in Q2.
Dragos analyst Abdul Alamri said most cases are opportunistic. Where OT or physical operations are hit, it is usually a by-product of attackers disrupting IT — as in the August 2025 Jaguar Land Rover breach, which halted manufacturing for months. Dragos also found that in 30 percent of the incidents it responded to in 2025, the investigation started not with a detection alert but with someone noticing that operations looked wrong.
Compliance-driven connectivity creates new attack surface
Matt Hayden, VP of cyber and emerging threats at General Dynamics Information Technology and a former DHS assistant secretary for cyber policy, said organisations are connecting equipment to the internet primarily to prove regulatory compliance. Refrigeration units, for example, report temperature and uptime so operators can show health inspectors a clean record.
Hayden made that point before the French incident. Afterwards, he described the attack as a significant example of devices with no data value and no enterprise access being exploited simply because they were internet-connected with unpatched firmware. He expects attribution to point to opportunists rather than a nation-state, and warned that the same pattern applied to more consequential equipment could scale quickly. As organisations shrink their IT attack surface, he said, OT will attract much more attacker attention.
Why it matters
For boards, this changes the ransomware conversation from data loss to operational and safety impact. A locked-out headquarters, a hospital without HVAC monitoring or a store chain writing off refrigerated stock are business-continuity and duty-of-care events, not just security incidents — and they shorten the time executives have before pressure to pay becomes acute. Building systems usually sit outside the CISO’s direct inventory, owned by facilities teams or third-party integrators, and are often connected for compliance reasons nobody in security signed off on. The French case shows that even low-value devices are worth attacking when the goal is disruption. CISOs should be able to tell the board which building and OT systems are internet-reachable, who manages them, and whether they would be detected if tampered with.
What to do now
- Build or refresh an inventory of BAS, BMS and other facility OT — HVAC, access control, refrigeration, fire panels — including vendor-managed and remotely monitored devices.
- Identify anything directly reachable from the internet and remove it, or place it behind authenticated remote access with MFA.
- Segment building systems from corporate IT and monitor the boundary; treat BMS-to-IT traffic as a potential persistence and pivot path.
- Cross-check BAS assets against the CISA Known Exploited Vulnerabilities catalogue and agree a patching or compensating-control plan with facilities and vendors.
- Review third-party and integrator remote access to building systems: shared accounts, default credentials and always-on connections.
- Add physical-impact scenarios — lockouts, HVAC or refrigeration failure — to ransomware tabletop exercises and business continuity plans, including manual overrides.
- Where compliance reporting requires connectivity, route it through a monitored, one-way or brokered path rather than direct device exposure.
