Refuse the command, or catch the drift within minutes. Three questions decide whether a night like this costs a store a fortune or nothing.
On the night of 11–12 October, attackers reached the refrigeration controllers of hundreds of French supermarkets and forced them into a continuous defrost at 50 °C. A second wave the next night hit stores using another vendor's controllers, and reports now include stores in five more European countries. In most cases, staff found the damage when they opened the doors.
No freezer broke. Every controller carried out a command it was built to carry out. Nobody with the authority to approve a 50 °C defrost at night had approved one, and nothing was watching closely enough to notice before morning.
The first wave, overnight on 11–12 October, hit stores running Danfoss refrigeration control software. Reports say firmware older than version 4 was targeted. Intermarché and Netto were hit hardest, followed by Coopérative U, Carrefour, Monoprix and E.Leclerc. Alsace, Normandy and the Grand Est were the worst-affected regions. One Super U reported losses of around €220,000; an Intermarché in Haguenau, around €50,000.
A second wave, overnight on 12–13 October, targeted stores using Dixell controllers. There, freezers were reportedly set to 150 °C instead of −22 °C, and fires were reported at some sites. The Paris prosecutor has opened an investigation, assigned to the cybercrime office OFAC with France's cybersecurity agency ANSSI, which has widened its alert to controllers on other kinds of equipment. No group has claimed the attacks.
In August, Claroty's Team82 disclosed three flaws in a widely deployed Danfoss refrigeration system manager. The first let an attacker work out a valid daily login from the date alone. The second turned that login into command execution. Claroty counted 2,765 such controllers reachable from the internet, and Danfoss released fixed firmware the same month. Whether these flaws were used here has not been confirmed. The shape of the attack is familiar either way: a management interface reachable from outside, a login that fails, and equipment that obeys whoever gets through.
A defrost is not an anomaly. Every refrigerated case runs several a day, and during each one the temperature climbs on purpose. Fixed alarm thresholds therefore have to tolerate a warm case for a while, or every scheduled defrost would page someone. An attacker who triggers a defrost is hiding inside the most normal warm-up the system knows.
And the readings that feed those alarms usually come from the same controller the attacker now commands. Claroty showed that a compromised controller can keep reporting normal temperatures. A device that is lying produces numbers that look perfectly plausible.
The usual advice is right: patch, and do not expose management interfaces to the internet. But patching answers one question. A night like this one turns on three.
If a controller answers to anyone who finds its address, its login is the only thing between the internet and the stock.
A controller checks that a command is well formed. It does not ask whether this person, at this hour, may set this temperature. A 50 °C defrost at 3 a.m. is a valid command and an unauthorised action.
If the only witness is the device under attack, the first alarm is the smell when the store opens. And a witness that cannot tell a scheduled defrost from an unscheduled one will either cry wolf several times a day or stay quiet all night.
Digital2win®'s Atelier runs operations on equipment the customer owns. It does not replace the controller. It decides which commands are allowed to reach it, watches what physically happens, and records both.
No open door. With atSign, people and agents reach equipment by cryptographic identity, not through a port that listens on the internet. There is no address for a scanner to find.
Every action checked against a signed envelope. Each command is tested against an authorisation that names who may act, on what, in which range and in which time window. A defrost set point of 50 °C, or a freezer set to 150 °C, sits outside any envelope a store would sign. The command is refused, and the refusal is sealed into the record like any other result.
An independent witness. A separate sensor, on its own network path, observes the physical outcome. It does not trust what the controller reports. When the two disagree, that disagreement is itself the alarm.
A forecast that knows the schedule. The witness's readings run through a time-series forecaster that is told when defrosts are planned. A scheduled defrost is expected, so it raises nothing. A warm-up that no schedule explains falls outside the forecast band within minutes of starting.
A record anyone can check. Each run is sealed and signed by the identities accountable for it. A third party can verify it against their published keys, without asking us.
The controller was capable of a 50 °C defrost. Capability is what the equipment can do. Authority is what the site has agreed it should do. Atelier keeps the two apart, and the witness makes sure that if they ever meet, someone knows within minutes.
Mistral released Timestral on 15 October, a family of open time-series forecasting models small enough to run on an ordinary in-store server without a GPU. Two of its features matter here. It forecasts related signals together, so a case's air temperature, evaporator temperature and door activity inform one another. And it accepts known-future inputs: things you know before they happen, such as the defrost schedule or opening hours. That is exactly what separates the 3 a.m. defrost the store planned from the one an attacker ordered.
The forecaster does not decide anything. It is a tripwire: when the witness disagrees with the forecast, Atelier opens an investigation, and the people and policies that hold authority take it from there.
We replayed a recorded fault from our physical bench through Timestral, as if live: a field device that stopped updating while still answering its controller, while an independent camera watched the belt keep moving. Two results matter for this story.
It caught the drift fast. On the device's counter, the forecaster flagged the very first frozen reading, about 30 seconds before our existing staleness rule fired, with no false alarms beforehand.
It could not catch a plausible lie on its own. The device's temperature froze at a believable 22.3 °C, and the forecaster never flagged it: the number was not surprising. The independent camera is what proved the line was still running. That is the supermarket problem in miniature. Run the forecast on the witness, not on the device under attack.
One recorded run on a bench conveyor, not a refrigeration study. We will publish refrigeration results when we have them.
Atelier sits in front of the equipment by design: we never reflash a customer's controller. Commissioning routes every remote command through the gate, an independent sensor is added where the site's own readings cannot be trusted, and the site keeps patching its firmware as it does today.
See a refused command, and a caught drift, for yourself. If you run cold-chain, building or process equipment, we will show you both on our bench, sealed and verifiable. Get in touch: linkedin.com/company/digital2win.