What actually happened in France?
Attackers changed the settings on the controllers that run a store's fridges and freezers. That is the box a refrigeration company uses to watch and adjust temperatures from somewhere else. Reporting names Intermarché, Coopérative U and Super U, Carrefour, Monoprix and E.Leclerc.
Store counts vary by source. Les Mousquetaires, which owns Intermarché, said about 150 of its stores were hit. Carrefour said 80. BleepingComputer cited French reports of 250 to 350 stores across all the chains.
The Paris prosecutor's office is investigating what it called a "large-scale" cyberattack. CERT-FR, France's national cyber emergency team, published an alert on October 12 reporting numerous break-ins on Danfoss refrigeration controllers. On October 13 it added controllers from Copeland and Dixell to the list.
Tell your staff
At your next staff meeting, ask one question: what in this building is connected to the internet that we never think of as a computer? Write down every answer.
How did the attackers get in?
Nobody knows yet, and nobody has said who did it. Danfoss said most of the units hit were older models that no longer get software or security updates. Some stores were reportedly reached through an outside company that manages their refrigeration. Intermarché told BleepingComputer the attack "reportedly" affected "a service provider that manages refrigeration systems in stores."
Security researchers warned in 2025 about flaws in one Danfoss model and found thousands of its management pages open to the internet. No one has confirmed those flaws were the way in this time, so do not read the story as settled.
What is settled is the advice. CERT-FR said that putting a device's management page on the open internet goes against good practice, and told owners to disconnect those controllers or tightly limit who can reach them.
Tell your staff
If a fridge, freezer or thermostat reads wrong, or a setting changes that nobody touched, tell a manager right away and note the time. Do not just reset it and move on.
Why should a small business in Northern Virginia care?
Because the same kind of gear sits in local businesses every day. Walk-in coolers in restaurants. Medication and vaccine fridges in medical and dental offices. Thermostats and HVAC controls in shops and offices. Cameras and door access systems almost everywhere.
A lot of it was installed by a vendor who set it up so they could reach it from their own office, then moved on. Nobody on your side may know that it is online, what password it uses, or whether the maker still sends updates for it.
The supermarket chains had refrigeration specialists on call and still lost stock. A single restaurant with one walk-in cooler has far less room to absorb a night like that.
Tell your staff
If a vendor or technician wants remote access, or wants to plug something new into your network, they check with the owner or manager first. Every time.
What should I check this week?
Most of this is an afternoon with a notepad and a couple of phone calls.
- List every device that is connected to the internet, including the ones a vendor installed: fridge and freezer controls, HVAC, thermostats, cameras, door access, alarm panels.
- Make sure no device's management page can be reached from the open internet. If you can log in to it from home without going through something you control, a stranger may be able to as well.
- Give vendors remote access through one controlled path you can switch off, such as a VPN or a remote access tool, not an open port on your router.
- Write down who owns each device, who services it, and whether it still gets software updates. If the maker has stopped updating it, plan its replacement.
- Change any default passwords, and give each vendor its own login instead of a shared one.
- Put a separate temperature alarm on anything where spoilage costs real money, one that does not depend on the same controller and alerts a person when it goes out of range.
- Ask your insurer whether spoiled stock or damaged equipment from a cyberattack is covered, and what they would need from you to pay a claim.
Tell your staff
Show everyone where the temperature alarm is, who it alerts, and what to do first when it goes off.
Can Papa Bear check our devices for us?
Yes. We can walk your location with you, find what is connected, check what can be reached from the internet, and help you set up vendor access that you control. Call us or send a note to book a check of your internet-connected devices.
If something in your building is already acting strangely, call us now. Do not wait for the next reading.