France has named a culprit for the supermarket freezer attacks, but the more useful questions are why they were so easy and what we are prepared to pay to make the next one harder
Resilience Media has already reported what happened when refrigeration controllers across Europe were told to heat up overnight, leaving supermarkets binning food, cabinets catching fire and blood banks fending off the same attack. France has since blamed Iran’s Revolutionary Guard for the October wave.
I will leave the detail of the attribution to others, because I am more interested in the lessons we take from this, and I am worried that we are about to take the wrong ones.
The comfort of blaming a state
There is something comforting about attributing an attack to a hostile state, because it implies an adversary so capable that no ordinary business could reasonably have been expected to stop it.
That is not what happened here. In France, most of the controllers were ageing Danfoss units, some of them out of support since 2016, connected directly to the public internet. How the attackers got in has not been officially confirmed, but the leading candidates are default passwords that had never been changed, which Danfoss says it found on systems hit in the second wave, and a hidden maintenance login that accepts a code derived from the date. That login was disclosed and fixed in the current model in 2025, the older models will never be patched, and either way the equipment was still sitting on the internet eighteen months later.
The standard advice is not new: if something doesn’t need to be on the internet, then don’t put it there. If it does, then make sure it is secure. And if it is obsolete and can’t be updated, then replace it or segregate it.
Those principles sit at the heart of the UK’s Cyber Essentials scheme, which still has a shockingly low adoption rate – roughly 7% of small companies, under 25% of medium-sized ones and, at best, around half of large ones. The advice is also a little glib, because every one of those options costs money, and a government attribution to a hostile state doesn’t pay the bill.
The AI red herring
The second wave arrived in the same week that the National Cyber Security Centre warned of AI-enabled attacks on critical infrastructure by 2028, and with all the recent hype about an AI cyber-pocalypse it was probably inevitable that the freezers would become an AI story. There is no public evidence that they are one, since the weaknesses in question were found and published by people.
My concern is that boards will hear “AI” and spend accordingly, and that somewhere a company is about to buy an AI threat detection platform while its freezer controller is still on the internet with its default password.
It’s also worth noting that no malware seems to have been involved: the damage was done with a defrost cycle and a temperature setting, both legitimate functions, by someone with a working login.
For years we have talked about an “assume compromise” approach to network security, and perhaps we now need to do the same with operational technology, which means asking not only how we keep an attacker out, but what a system will agree to do once they are in.
The cost of resilience
Those controllers were not on the internet by accident. Remote access allowed one engineer to look after hundreds of sites from a desk, without a van or a night shift, and so the exposure was in a very real sense the saving.
The French blood banks kept their plasma because an alarm sounded and staff were there to disconnect the equipment, whereas a London wholesaler whose automated warnings had been switched off found its cold rooms set as high as 66 degrees.
That leaves an uncomfortable choice. We can pay to do remote access properly, with supported equipment, segregated networks, proper authentication and alarms that an attacker can’t reach, or, where a system can’t be made secure, we can accept that remote access isn’t the answer and put a human back on site to monitor and adjust things. That person is exactly who we have spent years engineering out, along with the spare capacity and duplication that look like waste right up until the night they are needed.
One French chain reported losing tens of millions of euros in a single day, which would have paid for a great many site visits. Businesses, governments and individuals are all going to have to make decisions in which resilience is treated not as a cost to be trimmed but as an essential part of what is being bought.
What if it isn’t food next time?
France has called October the first cyber campaign on its soil carried out purely for sabotage, and it was not only about food. The same investigation found attempts on control equipment at several small hydroelectric plants, and the unit France has named has previously been linked to attacks on US water utilities.
This time it was industrial refrigeration, but fuel distribution, rail signalling, traffic management and water all share the same pattern of old equipment, remote access adopted for convenience and a contractor that nobody would think to describe as critical national infrastructure.
Whether it is drone incursions, physical sabotage or cyber attacks, it feels as though the scale of these isolated incidents is increasing, and my concern is what happens when they stop being isolated. We absorbed one bad night for freezers, but freezers, fuel and rail in the same week is a different question, and I am not convinced that we have a good answer.
And perhaps the most important question with all of these incidents is who stands to benefit, because if they are part of a wider hybrid campaign and not a run of bad luck, then we are going to have to invest in resilience across the board and not just in whichever system was hit last.
