In the early hours of October 12, 2026, hundreds of supermarkets in France woke up to find their refrigerators and freezers running at 50°C. It was not a power failure. A cyberattack had taken remote control of the systems that regulate refrigeration and forced them into a permanent defrost cycle. Chains such as Intermarché, Carrefour, E.Leclerc and Coopérative U had to destroy large quantities of food, and fires broke out in some stores. Three weeks later, on November 2, a second wave hit supermarkets in Belgium, Luxembourg, Ireland, the Netherlands, Sweden, Finland and Estonia. To date, no one has claimed responsibility for the attack or demanded a ransom.

The problem was not in the refrigerators, but in the equipment that manages them remotely. Supermarkets use central controllers, from manufacturers such as Danfoss and Copeland, that make it possible to monitor temperatures and adjust settings from anywhere. Many of them were connected directly to the internet, were easy to locate with specialized search engines, and were models the manufacturer had stopped updating years ago, or ran old software versions. Some of their vulnerabilities had been public since 2025, including one that allowed access with a predictable password calculated from the current date. Added to this was a contractual factor: in several cases, remote access was in the hands of external maintenance providers. The authorities have not yet confirmed the exact point of entry.

What is most striking is that, based on the public information known so far, preventing what happened did not require sophisticated technology. It would have been enough not to leave administration panels exposed to the internet and to allow access only through protected channels, such as a VPN. Likewise, replacing equipment no longer supported by the manufacturer, installing the available updates, which existed before the attack, and requiring providers to follow clear rules on how and from where they connect. Finally, temperature alarms independent of the attacked system would have helped.

This lack of limits was repeated on other fronts, and closing those gaps did not require major investment either. A cap on defrost duration that could not be changed remotely would have prevented that function from being used as a “weapon,” and an alert for mass or after-hours configuration changes would have flagged the attack without waiting for temperatures to rise. The same applies to access, which could be secured with a few measures, such as changing factory-default passwords and not reusing them across stores, regularly checking which devices are visible from the internet and, where a third party manages the equipment remotely, allowing it to connect only from its authorized IP addresses. This last measure has an added advantage: when the contract ends, simply withdrawing the authorization cuts off access, without depending on the provider to deactivate its accounts. And so that none of this is left hanging, someone within the organization should be responsible for deciding when a device that is no longer supported gets disconnected.

In the supermarket case, the attackers did not use a virus; instead, they exploited a normal function of the equipment, defrosting, pushed to an extreme that no one had limited.

The lesson goes beyond retail. Security cameras, HVAC systems, elevators, pumps or industrial machinery connected to the internet present the same risk. Every company should know which devices it has connected, who can operate them and whether they are still receiving updates. In Chile, the Cybersecurity Framework Law (Law No. 21,663) imposes risk-management duties on essential service providers and operators of vital importance that, in practice, also require them to review their relationships with suppliers, in addition to reporting incidents to the National Cybersecurity Agency (ANCI) within deadlines measured in hours. Reviewing the inventory of connected devices and contracts with technology providers today is a low-cost measure compared with damage that, as seen in France, can reach tens of millions of euros in a single day.

‍