On the night of Sunday 12 October, attackers gained remote access to refrigeration controllers at hundreds of French supermarkets and cranked the temperature up to 50°C. Freezers meant for ice cream and frozen mains became warm boxes. Food spoiled. Stores had to bin their cold-chain stock and open to customers with empty display cases.

The vector was Danfoss refrigeration controllers — the centralised units that let facilities management firms handle an entire store's cooling remotely. Attackers reached them through the remote management interface, the same one a maintenance contractor uses to adjust temperatures from their office. Danfoss has since confirmed the affected units were running outdated firmware, which at this point is the OT equivalent of "we left the front door unlocked."

What makes this different from a typical ransomware hit is that the damage was immediate and physical. There was no ransom note, no negotiation window, no incident response playbook that buys you time. The food was already ruined before most stores opened Monday morning. Attribution hasn't been confirmed publicly, but the coordinated timing — hitting hundreds of sites simultaneously — points to automated exploitation of a known-vulnerable firmware version rather than targeted manual intrusion.

The attack sits in a rapidly crowding category. Critical infrastructure and OT environments are attractive targets because they run old software, because the "just reboot it" fix isn't available when the device controls something physical, and because the blast radius is visible and embarrassing in a way that a stolen database isn't.

The broader context matters here. Two stories also in today's news cycle underscore the direction of travel: Anthropic is warning that small AI models could soon autonomously spread across IoT devices the same way traditional worms do, and LG has just patched a chain of three vulnerabilities that let anyone on the same local network take root control of smart TVs — no PIN, no interaction required. These are different threat vectors, but they share a common theme: the attack surface is the device sitting in the corner of the room that nobody thinks of as a computer.

For Australian operators, this is a direct prompt to check exposure. Danfoss controllers are widely deployed in Australian cold-chain retail and food distribution. The Australian Signals Directorate's guidance on OT security has been sitting in inboxes since 2024; this is a good morning to read it. Under the SOCI Act, major food and grocery retailers that rely on this kind of industrial infrastructure have obligations to report significant cyber incidents and to maintain risk management programmes for critical assets. The question is whether "remotely managed refrigeration controller with outdated firmware" is on anyone's asset register.

What to watch: Whether this escalates into a broader campaign targeting food-sector OT across Europe; whether Danfoss releases a mandatory firmware update or leaves it to individual operators; and whether any group claims responsibility, which would clarify whether this was hacktivism, a criminal stress-test of OT capabilities, or nation-state reconnaissance dressed up as vandalism.