At about 4 am in a supermarket in Gradignan, a delivery driver found the stockroom flooded. The site had raised no alarm, because the freezers had been set to defrost for up to eight hours, and that setting also postponed the alerts that would normally have woken someone.
The store was one of as many as 700 in France where attackers forced defrost cycles from 11 October, with cold-room temperatures reportedly reaching 50°C, and by 3 November retailers in several countries including the UK had been affected, according to The Guardian.
Refrigeration controllers manage defrost cycles, temperature thresholds, and alarms. Many are connected so contractors can change settings without visiting stores. For supermarket groups operating similar equipment across multiple sites, this creates a vulnerability that can extend well beyond an individual store.
Because defrosting is a normal refrigeration function, manipulated settings may initially appear to be an equipment fault rather than a cyberattack. The commands themselves may look legitimate, leaving the first evidence of an attack to appear in the equipment rather than the network.
The attack on France's national blood service on 2 November showed how similar vulnerabilities can affect critical infrastructure. Temperature and defrost thresholds at three cold-storage facilities managed by contractors were raised to extremely high levels, with readings as high as 110°C reported by Le Canard enchaîné.
The blood service is government critical infrastructure, even when contractors manage the refrigeration equipment. No motive is known, no one has claimed responsibility, and the method of access has not been disclosed.
A Pattern Retailers Will Recognise
The sequence fits industrial cybersecurity incident response data. Thirty percent of the cases one security firm handled in 2025 began as unexplained operational issues rather than security alerts, while 82 percent of asset owners in its exercises had no clear criteria for deciding when an operational anomaly should become a cybersecurity investigation.
For a supermarket, this could mean a store manager calling a refrigeration contractor about a warm cabinet without anyone in IT being notified. A failing compressor and a manipulated defrost schedule can look much the same at first, making it difficult to establish whether the problem is mechanical or deliberate.
France's CERT-FR cybersecurity alert, covering Danfoss, Copeland, and Dixell controllers, recommends removing direct internet exposure, restricting remote access through a VPN, and checking defrost schedules.
These precautions make it harder for attackers to gain access, but they do not address what happens once someone has gained control of a system. By the time a fault is identified, refrigeration equipment may have been running outside its normal parameters for several hours.
The same remote access exists in heating, ventilation, and other building management systems. Skilled attackers, increasingly assisted by AI, can use legitimate commands through authorised channels, making their activity difficult to distinguish from normal operations.
Reading the Equipment Instead of the Screen
Process-oriented OT Cybersecurity addresses this problem by monitoring physical equipment independently of its control system.
Electrical signal taps on defrost heaters, compressors, and evaporator fans passively measure the current each draws. The readings are transmitted over a separate, one-way path to a security team, outside the store's refrigeration network.
An attacker who controls the refrigeration manager has no network path to those readings. The controller can report whatever it likes while the equipment's electrical current tells a different story.
Consider a freezer room in a mid-sized supermarket on a Saturday night. The controller reports that defrosting finished at 11 pm, yet the heater continues drawing current, the compressor is idle, and the fans are off.
If the same pattern appears across several rooms within minutes, with no scheduled maintenance to explain it, the security team has reason to investigate. Staff can contact the store, cut the remote session, and arrange an independent temperature check with a handheld probe before significant stock losses occur.
This is an illustrative scenario based on the published details of the European attacks, not a reconstruction of an actual incident.
Questions for Monday Morning
Retailers do not need to wait for an incident to find out where they stand.
Refrigeration contractors and IT teams should be able to explain who can remotely change defrost and temperature settings, how that access is protected, and whether controllers have limits on defrost duration.
They should also know whether temperature records are kept somewhere the controller cannot alter, what happens when an alarm fails to activate, and when an unexplained refrigeration fault warrants a cybersecurity investigation.
If a controller reported normal conditions tomorrow morning while stock was warming, which source of evidence would the store manager be expected to believe?
by Amir Samoiloff, CEO, SIGA OT Solutions
