The Freezer Aisle Has an Admin Panel

The freezer aisle has an admin panel. The people writing the insurance claim would like a word about who could reach it.

On October 12, Reuters reported that attackers raised connected refrigeration at hundreds of French supermarkets to as high as 50°C, destroying food and causing fires. Intermarché said around 150 stores were affected; Carrefour reported 80. Those are attributed reports, not a complete independent count.^[1]

October 16: the warning is still operational

CERT-FR updated its alert on October 16. It lists compromises involving Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb remote refrigeration controls, and warns that attack campaigns are probably continuing. Its response starts with removing exposed management interfaces from the internet, then restoring access through a secure VPN or protected network and applying manufacturer guidance.^[3]

That is more than a patch reminder. The alert warns that resetting an unsupported, exposed device can remove persistence while leaving it vulnerable to another compromise. Ownership includes the network boundary, the device’s support status and the person responsible for putting it back into service.^[3]

Do not put separate incidents in one freezer

AP’s October 14 report separately described Ahold Delhaize’s Dutch disruption. The Dutch National Cybersecurity Center said it saw no reason then to link the food-sector incidents. Grocery-delivery outages should not be presented as a demonstrated consequence of the French refrigeration hack.^[4]

Claroty’s August research documented internet-exposed Danfoss AK-SM 800A controllers and vulnerabilities addressed by firmware R4.3.1. That technical history does not, by itself, establish the intrusion path used in October. The public record reviewed here identifies no perpetrator.^[2][4]

The useful question is who can prove the cold-chain controls are safely reachable after repairs. Manufacturer, installer, maintenance contractor and retailer each hold part of that answer. If the contract turns shared responsibility into an empty space, the thawed inventory will provide a remarkably expensive diagram.