On the night of October 11, attackers took remote control of refrigeration systems at hundreds of French supermarkets, switching units into defrost mode and driving temperatures as high as 50 degrees Celsius, according to Intermarché owner Les Mousquetaires. France’s finance minister, Roland Lescure, put the number of affected supermarkets at about 700, the Associated Press reported. No group has claimed the refrigeration controller cyberattack and the entry route has not been disclosed, but France’s CERT-FR has tied it to internet-exposed remote management controllers. A class of retail operational technology most people never think about has become a food security concern.
I covered the attack on a recent episode of my CyberSecureOT podcast, alongside the compromise of a ConnectWise cloud backup credential used against Microsoft 365 tenants and a two-year espionage intrusion hidden inside VMware Tools. The three incidents share one feature: the attackers used access paths that operators had deliberately created or trusted, from vendor maintenance connections on refrigeration controllers to an application identity with standing access to customer cloud environments.
Those connections are efficient and extremely convenient. Refrigeration technicians can adjust defrost schedules from home on a Sunday morning. But leaving critical operational systems directly exposed to the internet is a massive vulnerability and an open invitation for an attack.
Refrigeration controller cyberattack exposes vendor remote access
CERT-FR alert CERTFR-2026-ALE-012, first issued on October 12 and updated on October 13 and 16, reported numerous compromises of Danfoss AK-SM and AK-SC series controllers and Copeland and Dixell XWEB supervisors, a product family in which Claroty Team82 had earlier identified vulnerabilities in Copeland XWEB Pro. The agency warned that attack campaigns were likely still under way and advised operators to remove internet exposure, restore access only through a secure VPN or protected network, check defrost schedules, update firmware, and change default passwords. It cautioned that a factory reset would not protect end-of-life equipment without available fixes, which would likely be compromised again.
Affected retailers included Intermarché and Netto, Carrefour, Monoprix, and Coopérative U, whose chief executive said the company is not a Danfoss customer, according to The Register. Danfoss told reporters the affected stores were running outdated firmware. According to The Hacker News, the affected equipment included AK-SM 800 controllers, which reached end of life in May 2021, and AK-SC 355 units phased out in 2016, as well as current AK-SM 800A units on outdated firmware. Les Mousquetaires’ chief executive expects losses of tens of millions of euros, and the Paris prosecutor’s office opened an investigation covering spoiled food and equipment fires.
The attackers did not need to touch a corporate network to reach these devices. Vendors often create a public internet connection just for diagnostics and maintenance of their control systems, and anyone online can find exposed industrial devices with a search engine such as Shodan. The Register reported that Shodan searches showed more than 4,500 internet-facing Danfoss controller interfaces, more than half of them in France.
Known vulnerabilities, unconfirmed entry point
Claroty Team82 had disclosed three flaws in the AK-SM 800A, including CVE-2025-41450, an authentication bypass built on a hidden daily code derived from the device’s date. Danfoss fixed that flaw in version 4.2 in March 2025 and two post-authentication flaws, including a command injection issue, in version 4.3.1 that August. Security researcher Kevin Beaumont called exploitation “a zero-skill thing to pull off,” according to The Register, and Claroty Team82 has since shown that AI tools could rebuild exploits for the Danfoss controller flaws in 28 minutes.
I called out CVE-2025-41450 on the show. To be precise about where things stand, neither CERT-FR, which cites no CVE in its alert, nor Danfoss has publicly confirmed which vulnerabilities or credentials the attackers used. My advice is the same either way: scan your own networks for affected AK-SM 800A firmware and fix it. End-of-life models cannot be fixed at all, whichever route the attackers took.
The activity did not stop in France. On November 2, refrigeration equipment at supermarkets and butcher shops in Belgium, Sweden, Ireland, the Netherlands, and several other countries was remotely heated. Danfoss said the Dutch incidents matched the French method and that the affected systems were not on a secure network and still used default passwords. Belgium’s federal prosecutor opened a criminal investigation, and the country’s Centre for Cybersecurity said the attackers’ identity may never be determined.
The fix is architectural, the same lesson as the Minnesota water attacks covered earlier in this series. Operational technology must be secured at almost any cost. You cannot just plug a commercial freezer into the internet. Put these devices behind VPNs and segment your network so that even if the internet connection is found, the hardware remains invisible to the outside world.
Stolen application credential turns a vendor into an entry point
The ConnectWise incident applied the same logic to cloud access. On October 15, attackers used a compromised credential belonging to ConnectWise Cloud Backup, formerly SkyKick, to obtain Microsoft Graph tokens in customer Microsoft 365 tenants, according to Huntress. Huntress confirmed unauthorized sign-ins to 162 tenants by October 16 and observed a ConnectWise management application granting itself Global Administrator rights in one tenant before new credentials were added to other applications for persistence. Huntress also cited a Microsoft attribution of the activity to a group tracked as Storm-0940.
ConnectWise disabled seven application identities on October 17 and suspended its Cloud Backup, SaaS Security, and Cloud Management services, Help Net Security reported. The company said it had no evidence that stored backups were accessed and that whether a product vulnerability contributed had not been established. The suspension left customers without scheduled backups or restore capability while the investigation continued.
This is the dark side of convenience, and it mirrors the vendor access risks industrial operators already contend with at the perimeter. Every app, every integration, and every automated service you grant access to is a potential doorway for an attacker. That is why I am not ready to connect control systems to the cloud right now.
Trusted software conceals long dwell times
The third case shows how trusted tooling can stretch an intrusion out for years. Russian security firm Solar reported that Partisan Zmiy, also known as the Belarusian Cyber Partisans, maintained access to an unnamed Russian healthcare organization for nearly two years before the intrusion was discovered in December 2025, according to reporting by The Hacker News. The attackers placed executables in, or replaced legitimate libraries within, the VMware Tools directory, and used the Telegram-controlled Vasilek backdoor for command and control. The group’s past targets have included Belarusian government institutions and the country’s railway system.
VMware Tools is foundational infrastructure. Many of us run it in our own home labs, and security tooling tends to treat it as belonging there. You have to look past that trust. You cannot assume a file is safe because of its name or its timestamp. Verify digital signatures, look for unsigned code running in privileged locations, and assume that a silent network is not necessarily a secure one, because sometimes silence just means the enemy is already inside.
Remote access governance becomes the measure to watch
Several questions remain open. French and Belgian investigators have not disclosed the intrusion route or the attackers’ identity, ConnectWise has not explained how its credential was exposed, and CERT-FR’s alert indicates compromises may be continuing.
For asset owners, these cases make remote access the practical test. Do you know which of your building, refrigeration, and process controllers are reachable from the internet? Which service providers hold standing access to them? Are end-of-life devices still in production? And which third-party applications hold privileged rights in enterprise environments that connect to operations? The Copeland and Dixell entries on CERT-FR’s list show the exposure extends well beyond a single vendor.
You can hear the full discussion on this episode of CyberSecureOT.
