A Playbook Run Twice
On the night of October 11–12, 2026, hundreds of French supermarkets, Intermarché, Netto, and the U Group banner stores, woke up to a costly discovery: their refrigeration units had been running in continuous defrost mode for several hours. The mechanism matters. The compromised controllers had activated the heating elements built into the refrigeration units, resistors designed to clear frost on a timed cycle that become destructive when they loop unchecked. Some units reached 50 °C. Food losses across affected sites were severe.
Three weeks later, on November 2, the same method struck again. Belgium, Luxembourg, Sweden, Ireland: Ahold Delhaize, Colruyt, ICA, Coop, and Musgrave/SuperValu franchisees all reported similar incidents. No group has claimed responsibility for either campaign.
Same Vulnerability, Same Inaction
Both waves exploited the same attack vector. Danfoss controllers (AK-SM 800A series) and their Copeland/Dixell XWEB equivalents had exposed a web server directly on the internet, and on a significant number of sites, with the factory-default credentials still in place. Claroty researchers had documented three critical vulnerabilities in August 2026, more than two months before the first campaign. None had been patched.
France's CERT-FR issued an advisory on October 12. It clearly wasn't enough to drive updates across the full European installed base in the weeks that followed. The result: the same exploit was replayed, unchanged, across a new geographic footprint.
What Behavioral Detection Could Have Done
A thermal reading climbing from -18 °C to 50 °C in a matter of hours is a statistically unambiguous anomaly in any refrigeration unit's telemetry. For a machine-learning model trained on real-world OT data, this signal is trivial to surface, far simpler to flag than a network intrusion that can blend into legitimate traffic.
Industrial environment monitoring platforms, Claroty, Dragos, Nozomi Networks, and Sentryo (now integrated into Cisco), do exactly this. They learn the normal operating cycles of each asset, scheduled defrost included, and trigger alerts the moment behavior deviates meaningfully. An alert generated minutes into the incident would have enabled remote isolation of the affected equipment and contained the damage, rather than leaving staff to discover it at dawn.
AI is not a substitute for patching a vulnerable firmware. But it is a critical operational safety net when the patch hasn't landed yet, and in OT environments, lag windows routinely run to weeks or months.
The Real Cost of OT Blind Spots
IT/OT convergence is already an operational reality for retail, manufacturing, building management, and healthcare. Physical assets, temperature controllers, PLCs, HVAC controllers, now share the same network infrastructure as servers and workstations. They rarely receive the same level of oversight.
NIS2 obligations, which apply to essential and important entities, explicitly require risk management to cover connected physical assets. For organizations that have not yet inventoried their OT estate or deployed behavioral monitoring, these two campaigns deliver a concrete warning: next time, it may not be refrigerators at stake.