"Any IoT device that can’t be updated is vulnerable. And, probably, any IoT device that can be updated is also vulnerable," the blog post observed, summarizing the central technical and operational fault line exposed by the incident.
How attackers altered refrigerator behavior
Hackers gained control of the software that regulates temperatures on refrigerated units in France, according to the report. The attackers manipulated controls overnight so that some refrigeration units warmed dramatically; one supermarket chain affected said units reached roughly 50°C (120°F) during the episode. The takeover went beyond the routine overnight defrost cycle—those short, modest temperature rises that stores expect—because the intruders ordered the machines to heat and to remain hot rather than to return to normal cold temperatures.
Danfoss: older models and unpatchable security
Manufacturer Danfoss responded by noting that the cold units implicated were older models whose security software could not be updated to address a risk the company had already identified. Danfoss did not confirm specific reports about exactly how warm the fridges and freezers became during the attack, but the company’s statement tied the incident to devices that lack updatable security.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleOperational consequences reported by a supermarket chain
At least one supermarket chain reported unusually high temperatures—about 50°C (120°F)—in affected refrigeration units overnight. The chain’s report is the principal operational detail released about immediate effects. Beyond that note, the account emphasizes that the attackers’ commands differed from normal maintenance operations: rather than a brief defrost, the units were directed to heat and stay warm.
Patchability as the central technical vulnerability
The incident highlights a core technical premise plainly stated in the source: if a connected device cannot receive security updates, it is vulnerable. The blog post goes further, warning that even devices that can be updated remain at risk. In this case, the inability to install a remedial security update on older Danfoss models left those units exposed to remote manipulation of temperature set points—precisely the mechanism the attackers used to alter refrigeration behavior.
What this means for Danfoss, supermarket operators, and security teams
- Danfoss: The company has identified a risk tied to specific older models and acknowledged those units could not receive the necessary security update. Danfoss will likely need to reconcile the exposed installed base—older non-updateable units—with whatever remediation options it can provide, a constraint the company itself highlighted.
- Supermarket operators (the affected chain and peers): Operators that rely on remote-control-capable refrigeration hardware must now weigh the exposure of aging equipment that cannot be patched. The affected supermarket chain’s report of temperatures near 50°C (120°F) underscores the potential for severe operational disruption when control software is subverted.
- Security teams and technologists: The event reinforces the danger of non-updateable IoT field devices and the broader point made in the source that updateability alone is not a panacea. Security teams will have to prioritize inventories of devices that cannot be patched, assess isolation or compensating controls, and plan for replacement life-cycles where updates are impossible.
The episode in France is short on public technical detail about the intrusion vector, but it is clear about three facts: attackers seized temperature-control software; at least one supermarket chain reported units warming to about 50°C (120°F); and Danfoss pointed to older, non-updateable units as the locus of the vulnerability. Those three facts form a tight narrative about the intersection of aging infrastructure and connected-control risk.
Concluding observation: the incident is an immediate reminder that the security posture of long-lived physical infrastructure—refrigeration units in this case—can be degraded not by a single misconfiguration but by the simple fact that a device cannot be patched. The practical question left on the table is operational and managerial: how should owners of installed fleets that include non-updateable devices budget and plan to reduce the window in which such devices can be exploited? The facts reported here make clear that, for now, the answer will matter not just to manufacturers and operators but to any business that depends on remotely controlled, temperature-sensitive equipment.
Original story: https://www.schneier.com/blog/archives/2026/10/cyberattack-on-connected-fridges-in-france.html
