Weaponizing a Refrigerator: A Wake-Up Call for Connected Product Security
TL;DR: A cyberattack on French supermarkets shows how unsupported, internet-connected devices can become targets for destructive attacks. Last week, we looked at the attack from a software modernization angle. This week, we offer some actionable steps to take to beef up the cybersecurity of your connected devices.
Overnight on Sunday, October 11, 2026, attackers reached refrigeration controllers in hundreds of French supermarkets and turned them against the food they were meant to protect. They remotely forced defrost cycles, driving some units up to 50 °C (122 °F). One chain, Intermarché, reported that about 150 of its stores were hit, with fridges heating for roughly six hours.
Legacy Models No Longer Received Updates
The common thread appears to be a single supplier of remotely accessible refrigeration controllers: Danfoss. The company says most of the affected controllers were legacy models that no longer receive software or security updates. Some newer units that were still supported were also affected, but they had not been updated.
Investigations are underway, and details are still emerging. In particular, the specific flaw exploited hasn’t been confirmed. But enough is known to see a pattern likely to repeat: old products with published vulnerabilities, no prospect of being patched, still connected, and widely used across many countries.
Note that, as far as has been reported, this attack required neither malware nor a zero-day exploit. All it appears to have needed was a communication link to an unsupported product.
The Overlooked Attack Surface
A refrigeration controller doesn’t seem like a cybersecurity asset. It’s bought by facilities teams, installed by a service contractor, and expected to run quietly for a decade. But it runs software. It has a management interface and remote access for service, and because of that, it carries the same exposure as any server, usually with less oversight.
Also notable: there was no reported ransomware and no reported data theft, just destructive intent. As long as unpatched systems with known vulnerabilities remain in service, copycat attacks are likely to follow.
5 Measures Product Companies Should Take Now
If you're building embedded systems, industrial equipment, medical devices or other connected products, you should:
- Know what’s in your software. Maintain an SBOM and monitor its components for new vulnerabilities.
- Publish a support period. Customers should know how long a product will receive security updates, and plan around it.
- Make updates easy to deploy. Over the air updates are the new normal. A patch that requires a site visit will not reach most of the installed base.
- Lock down remote access. Maintenance channels need strong authentication and encrypted communication, not convenience defaults.
- Budget for sustainment. Security maintenance is an ongoing engineering cost, not a one-time launch task.
The French attack didn’t need a software virus or a stolen password. It needed old software on equipment nobody was watching. Every connected product your company ships will one day be that equipment. The question is whether you planned for that day when you wrote the code.
If you need help strengthening your organization’s cybersecurity, get in touch with our experts for practical guidance and solutions tailored to your needs.
The French refrigerator hack also highlights the hidden costs of unsupported software. Read more in our blog, When It Comes to Legacy Software, Cybersecurity is a Lifecycle Issue.