Confirmed reporting: Refrigeration controllers at numerous French supermarkets were remotely manipulated, including extended defrost cycles and temperature setpoints reportedly reaching 50°C. Food was spoiled, and some reporting describes equipment fires. Estimates range from “hundreds” to roughly 700 stores, so the precise scope is not yet settled. This is a high-severity safety and continuity incident: the immediate consequences are unsafe food, inventory destruction, possible equipment damage, and store closure—not primarily loss of payment or customer data.
Not established: Public reporting does not identify the initial-access method, attacker, or indicators of compromise. Internet-exposed Danfoss systems, end-of-life controllers, outdated AK-SM 800A firmware, and previously disclosed vulnerabilities establish opportunity, but they do not prove those vulnerabilities caused this incident. Reports also mention Copeland and Dixell controllers, further weakening any single-vendor exploit theory. At Purdue Levels 1–2, the dangerous capability is changing refrigeration operation; the suspected route is through external remote management into supervisory control. That causal path remains unproven.
First hour: Treat affected stock as a food-safety hold and involve the refrigeration contractor, store operations, food-safety lead, and security team. Record temperatures, alarms, setpoints, defrost schedules, controller logs, remote sessions, and firewall records before resetting anything. Verify locally that compressors, evaporator fans, probes, and protective interlocks are behaving correctly. If local control is stable, block the controller’s northbound internet or vendor-remote-access path at the firewall, while preserving validated controller-to-equipment and local alarm communications. Do not power off controllers or make an untested segmentation change merely to “disconnect” them; that could stop refrigeration or suppress alarms. If the controller cannot operate safely without remote connectivity, move to staffed manual/local operation under the refrigeration contractor’s direction before cutting access.
First day: Inventory controller models, firmware, exposed interfaces, credentials, and vendor connections across every store; rotate remote-access credentials, restrict access to named sources through VPN/MFA or an OT jump host, and monitor for setpoint, defrost, account, and configuration changes. Quarantine affected stock according to food-safety procedures and preserve controller images/configurations for investigation. Apply firmware only after vendor compatibility review and testing, with rollback and a maintenance window—an IT-style emergency reboot across stores could create a second outage. I would raise this to critical with verified fires, refrigerant release, defeated safety interlocks, sustained compressor damage, or coordinated compromise across several controller families; I would lower it if logs show brief supervisory tampering with local protections intact and limited store impact. Exploit logs or forensic artifacts tying the intrusion to a specific disclosed vulnerability would change the recurrence assessment, but not by themselves the physical-severity rating.