In the night between the 11th and 12th of October 2026, attackers forced the refrigeration controllers of hundreds of French supermarkets into a continuous defrost cycle. Temperatures in fridges and freezers climbed to as much as 50 °C. Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc were among the chains affected. The owner of Intermarché, Les Mousquetaires, expects losses in the tens of millions of euros. The impact was not limited to France. Reuters quoted a Sekoia analyst reporting affected systems in Spain, Portugal, Poland, Germany, and Belgium.
What happened, and what we don’t know yet
CERT-FR identified compromises affecting Danfoss AK-SM and AK-SC controllers, as well as Copeland/Dixell xweb refrigeration-management systems. Danfoss says most hit units were legacy products that no longer receive security updates. The AK-SM 800 has been end-of-life since 2021, and the AK-SC 355 was phased out in 2016. The attack followed Claroty’s August publication describing vulnerabilities in Danfoss refrigeration controllers, but whether those specific flaws were exploited in October remains publicly unconfirmed. The controllers allow maintenance providers to manage refrigeration systems remotely. Following the attack, French authorities urged operators to remove public internet access and restore remote access only through a protected network.
The entry point and the attackers’ identities remain unconfirmed. CERT-FR has not identified a specific vulnerability used in the attack, and neither CERT-FR nor Danfoss has publicly attributed it.
Criticality of OT security
If a system controls temperature, equipment, food, or medicine, it belongs on the CISO’s risk map. Three things made this attack possible:
- Long equipment lifecycles. Controllers, PLCs and sensors often run 15 to 30 years, far beyond vendor support. Patching means downtime, recertification, and vendor dependency.
- Remote third-party access. One compromised provider credential or exposed portal can reach hundreds of sites at once.
- Unmonitored networks. Harmful changes to controller settings can go unnoticed without effective monitoring of both remote access and the physical process.
Similar risks arise wherever connected systems control essential physical operations, from vaccine storage and water treatment to data-center cooling and electricity infrastructure. OT systems can remain in service for decades, while operational constraints can limit patching, active scanning and planned downtime. These devices can’t support the use of agents. Active scans can crash them. Sensor-heavy projects stall in planning while blind spots accumulate. The organizations in that position are obliged to protect, segment, and audit systems they cannot fully see.
Where does Exeon.NDR fit?
Exeon.NDR starts with visibility: passive, agentless, and based on network metadata you already have (NetFlow, IPFIX, firewall and DNS logs). Nothing is injected into the OT network, so there is no production impact.
- See what you have. Automatic asset discovery and communication mapping surface devices no spreadsheet lists, including management interfaces and remote-access paths that bypass intended controls.
- Validate segmentation continuously. Firewall rules describe what is permitted, while metadata shows what actually happens. Temporary maintenance rules that are never removed are exactly how controllers end up exposed. Exeon.NDR compares observed flows against intended policy, so segmentation is monitored rather than assumed.
- Detect abnormal behavior. ML-based behavioral analytics flag new connections, unusual external communication, unexpected remote sessions and lateral movement, independent of payload encryption and without signatures.
- Investigate and prove. Historical network evidence supports forensics, regulatory reporting (NIS2 24-hour notification) and audit readiness. Alerts flow into your existing SIEM and SOC.
Proof from the field: a large German distribution system operator (KRITIS) combined Exeon.NDR with targeted Deep Packet Inspection on its own air-gapped infrastructure. It got one IT/OT view and actionable monitoring about two weeks after technical installation.
Five questions to strengthen your OT security
- Do you know every connected controller, its firmware, and whether it is reachable from outside?
- Which third parties can reach your OT remotely, and how?
- Is segmentation verified continuously, or only at audit time?
- Would you notice abnormal behavior on those devices tonight, not tomorrow morning?
- What physical fail-safe stops a corrupted command from causing damage?
