Summary
- Attackers gained control of refrigeration management software at French supermarkets, forcing some units to heat to 50°C overnight.
- The affected units were older models that could not receive security updates, according to manufacturer Danfoss.
- Danfoss acknowledged it had previously identified the risk but could not remediate legacy hardware through software updates.
- The incident illustrates the compounding risk of unmanageable IoT assets in operational environments.
- Security researcher Bruce Schneier noted that both unpatchable and patchable IoT devices carry inherent vulnerability.
What Happened
Attackers compromised the software controlling refrigeration units across at least one supermarket chain in France, manipulating temperature settings overnight. Rather than the brief, shallow warming that occurs during a normal defrost cycle, the units were forced to heat up and remain at elevated temperatures. One affected supermarket chain reported temperatures reaching 50°C. The full scope of affected sites has not been confirmed in available sources.
The Manufacturer’s Position
Danfoss, the refrigeration controls manufacturer whose systems were involved, confirmed that the affected units were older models. The company said the security software on those devices could not be updated to address a risk it had already identified. Danfoss did not confirm specific figures on how warm the units became during the attack. Beyond that, details about the attack vector, the number of sites affected, or the identity of the threat actors are not available from the source material.
Legacy Hardware and the Patching Dead End
The core operational problem here is one that security teams encounter repeatedly across industries: hardware that has reached the end of its supportable life but remains connected and in active service. When a manufacturer identifies a vulnerability and cannot issue a remediation because the platform simply will not accept updates, the organisation operating that equipment carries the residual risk with no vendor-side resolution available. This is not a theoretical gap — in this case, Danfoss says it knew about the risk and could not close it.
A Broader Point on IoT Risk
Security researcher Bruce Schneier, writing about the incident, offered a pointed observation: any IoT device that cannot be updated is vulnerable, and — by extension — any IoT device that can be updated is probably also vulnerable. That framing is deliberately unsettling, but it reflects a genuine asymmetry in the IoT landscape. Updateability is a necessary condition for maintainable security, but it is not a sufficient one. Organisations that have ticked the box on firmware update capability should not read that as a resolved risk.
Operational Technology Is Not a Separate Problem
Connected refrigeration sits at the intersection of IT and operational technology. The consequence of compromise here was physical — food spoilage, supply chain disruption, potential regulatory exposure around cold-chain integrity. For CISOs whose remit includes retail, food distribution, pharmaceuticals, or any environment with connected physical systems, this is a reminder that cyber risk and operational risk are the same risk.
Why it matters
This incident reinforces that legacy IoT and OT devices sitting outside the standard patch management lifecycle are not merely a compliance gap — they are an active liability with real operational consequences. CISOs need visibility into which connected assets in their environment are beyond vendor support, what compensating controls exist, and whether the business risk of keeping those assets online is being consciously accepted at an appropriate level of authority. The attack also demonstrates that adversaries are willing to target operational systems, not just data, to cause tangible harm.
What to do now
- Audit connected IoT and OT assets to identify devices that cannot receive security updates, and document the known risks associated with each.
- For legacy devices confirmed as unpatchable, assess whether network isolation or decommissioning is operationally feasible as a compensating control.
- Engage vendors of connected operational equipment — including refrigeration, HVAC, and building management systems — to understand their update and end-of-support policies before procurement and at regular intervals thereafter.
- Ensure that residual risk from unpatchable IoT assets is escalated to and formally accepted by appropriate business stakeholders, not left as an unacknowledged technical debt item.
- Review monitoring coverage for anomalous behaviour on OT-connected networks, recognising that temperature and control-system telemetry may provide early indicators of manipulation.
