Cold War: Anatomy of an Operational Tech Cyberattack
What if one of the best illustrations of an OT cyberattack was a supermarket refrigerator?
By Ian McGuffin
When we think about cyberattacks against operational technology (OT), we often imagine catastrophic failures at critical infrastructure facilities.
These scenarios dominate discussions about industrial cybersecurity today, but what if one of the best illustrations of an OT cyberattack was…a supermarket refrigerator?
In October 2026, unidentified attackers demonstrated just how vulnerable everyday operational infrastructure can be. They didn’t need sophisticated malware, destructive payloads, or elaborate industrial exploits. Instead, they reportedly manipulated refrigeration systems, turning an ordinary operational function into a weapon.
The result? Spoiled food, disrupted operations, and significant financial losses.
Sometimes, the most effective cyberattack doesn’t break the machine. Instead, it exploits the machine’s intended functionality, causing it to produce an undesirable or unsafe result.
The Attack
On October 11–12, 2026, attackers reportedly compromised refrigeration management systems across several French supermarket chains. Estimates suggest that between 250–350 stores were affected.
Attackers reportedly manipulated refrigeration controllers to initiate unauthorized defrost cycles, interrupting compressor-driven cooling and potentially activating evaporator heating elements. This disrupted temperature regulation, causing refrigerated compartments to exceed safe operating thresholds and compromising perishable inventory.
French cybersecurity authorities subsequently confirmed widespread compromises involving Danfoss AK-SM and AK-SC controllers, alongside Copeland and Dixell XWEB systems.
Let’s break this down, using an adapted version of the two-stage of the Industrial Control System (ICS) Cyber Kill Chain developed by Michael Assante and Robert Lee (2015).
Stage 1 — Cyber Intrusion Preparation and Execution
Phase 1: Reconnaissance and Targeting
The attack likely began with identifying internet-exposed refrigeration management systems. Using reconnaissance platforms such as Shodan or Censys, attackers can discover publicly accessible industrial controllers, enumerate exposed services, and potentially identify device manufacturers, models, and firmware versions.
In this incident, the affected environments included Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration management systems. These supervisory controllers provide centralized monitoring and control of refrigeration equipment, including temperature setpoints, compressor operation, alarms, and defrost schedules.
Vulnerability: Direct internet exposure of OT management interfaces creates an externally accessible attack surface. Poor network segmentation effectively removes multiple defensive layers between an attacker and the physical process.
Mitigation: Remove refrigeration controllers from direct internet exposure. Place management interfaces within segmented OT networks and require authorized remote access through a controlled gateway.
Phase 2: Initial Access and Exploitation
After identifying potential targets, attackers would need sufficient access to manipulate the refrigeration systems.
The exact initial-access mechanism remains unconfirmed as of today. However, previously disclosed vulnerabilities affecting Danfoss AK-SM 8xxA controllers provide examples of potential exploitation pathways.
CVE-2025–41450 involves authentication bypass, while CVE-2025–41451 involves command injection. Depending on the affected configuration, these weaknesses could permit unauthorized interaction with management functions or execution of commands.
Although these vulnerabilities illustrate plausible exploitation pathways, neither has been publicly confirmed as the initial-access mechanism in this incident.
Vulnerability: Exploitable controller firmware, weak authentication mechanisms, and insufficient access restrictions can allow unauthorized users to gain control over management functions.
Mitigation: Start with applying vendor security updates during approved maintenance windows, accounting for operational availability and compatibility requirements. Also, enforce strong authentication on remote-access gateways, restrict administrative privileges, and monitor controller authentication and configuration activity.
Stage 2 — ICS Attack Development and Execution
Phase 3: Process Discovery and Attack Preparation
With sufficient access, an attacker could determine how to manipulate the refrigeration system to achieve a desired physical effect.
Get Berkeley I School’s stories in your inbox
Join Medium for free to get updates from this writer.
Refrigeration management controllers maintain information about operating temperatures, equipment status, alarm thresholds, and defrost configurations. An attacker with sufficient privileges could examine these parameters to identify functions capable of interrupting normal refrigeration.
Defrost cycles are particularly relevant. During normal operation, these cycles temporarily suspend refrigeration and, depending on equipment configuration, activate heating elements to remove accumulated ice from evaporator coils.
Manipulating their timing, frequency, or duration could interfere with temperature regulation without requiring specialized malware or modifications to lower-level controller logic.
However, there is no public confirmation that the attackers performed a distinct development or testing phase.
Vulnerability: Excessive administrative privileges and inadequate separation between monitoring and control functions.
Mitigation: Establish approved operating baselines for defrost schedules, temperature setpoints, and equipment configurations. Then, engineer alerts on deviations from these baselines, particularly changes made outside authorized maintenance windows.
Phase 4: Manipulation of Control
This is where the incident becomes a particularly compelling example of an OT cyberattack.
Attackers reportedly manipulated legitimate refrigeration defrost functionality, interrupting normal cooling operations and potentially activating evaporator heating elements. Repeated or improperly timed defrost cycles can prevent refrigerated compartments from maintaining their required temperatures.
In the terminology of the SANS ICS Cyber Kill Chain, this represents Manipulation of Control: using access to an industrial control system to alter the behavior of the underlying physical process.
Vulnerability: Insufficient validation and monitoring of control commands allow legitimate industrial functions to be executed outside their intended operating conditions.
Mitigation: Implement process-aware monitoring that correlates defrost commands with equipment status, temperature readings, and approved operating schedules. More importantly, establish independent temperature monitoring, operational alarms, and engineered safeguards that prevent unauthorized commands from compromising critical storage conditions.
Phase 5: Physical and Operational Impact
The final consequence was not data exfiltration or encrypted systems. It was a disruption of a physical process.
As refrigerated compartments exceeded acceptable temperature thresholds, supermarkets endured food spoilage, inventory disposal, operational interruptions, and financial losses.
This illustrates a fundamental difference between IT and OT cybersecurity. A cyberattack against enterprise IT primarily threatens information systems and business services. An OT attack can directly affect the integrity of a physical process, even when the equipment itself remains operational.
The SANS framework specifically recognizes process manipulation as a potentially more consequential objective than conventional system disruption.
Vulnerability: Dependence on compromised supervisory controls, combined with insufficient independent monitoring.
Mitigation: Deploy independent temperature monitoring and alarming, establish operational fail-safes, and develop incident-response procedures for compromised refrigeration controllers.
The Bigger Picture
This incident demonstrates a fundamental principle of OT cybersecurity: attackers don’t necessarily need to compromise individual field devices or move laterally through an enterprise network to manipulate physical processes. A command executed through an insecure control pathway can produce significant physical and financial consequences.
Whether it’s a refrigerator, industrial furnace, water pump, or manufacturing line, the principle remains the same — while enterprise IT security often focuses on protecting information, OT security must also protect the integrity of physical operations.
The most dangerous command isn’t always malicious. Sometimes, it’s a legitimate command issued with illegitimate intent.
Ian McGuffin is a recent alumnus of the MICS program, having graduated in 2026. He is currently an IT Security Manager at Sazerac Company.
References
Assante, M. J., & Lee, R. M. (2015). The industrial control system cyber kill chain. SANS Institute. https://sansorg.egnyte.com/dl/k7gJ2gVBj5
CERT-FR. (2026, October 16). Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (CERTFR-2026-ALE-012). Agence nationale de la sécurité des systèmes d’information (ANSSI). https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012
Danfoss. (2025). Danfoss security advisory DSA-2025–03–01. https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-03-01/
Gatlan, S. (2026, October 12). Cyberattack shuts down refrigerators at French supermarkets. BleepingComputer. https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/
