The French supermarket refrigeration hack is a warning for every unpatched controller in the connected physical world
When we think of OT Security and ‘Critical Infrastructure’, we tend to think of the big stuff: power plants, water treatment plants, oil & gas refineries. And rightly so, as we’ve seen attacks on Poland’s power grid, Jaguar Land Rover’s auto production facilities, and most recently a host of US water treatment facilities by Iran.
These incidents demonstrate that we’ve moved from theoretical risk to an accelerating volume of real-world threats. But OT security attack vectors go well beyond these big infrastructure examples to much more nuanced and esoteric ones, and we are beginning to see these attacks in these environments as well.
On October 11th, attackers took over the refrigeration coolers of several hundred French and Dutch supermarkets and set them to 50°C (122°F). Food spoiled and sprinklers flooded stock rooms as several stores reported fires. Intermarché’s CEO put the damage at tens of millions of euros in a single day. The attackers went after a piece of store infrastructure almost no security team owns: the cooling plant.
No payment system was hacked, and no customer data was reported stolen. Many stores learned of the attack only when staff arrived in the morning, because temperature alarms route to facilities contractors, not a security operations center.
The ‘End of Life’ Support Threat
None of this is to say that the manufacturer wasn’t aware of the risks. Danfoss, the maker of the refrigeration units, had patched its current controllers after Claroty researchers reported flaws last year. The challenge is that the units that failed were older models it no longer supports.
Keeping current in OT therefore means three things together: an inventory of firmware and support status at every site, patching (or other mitigations) written into contractor obligations, and budgeting replacement of end-of-life controllers as a planned capital item. This is easy to say, but incredibly difficult to accomplish across hundreds or thousands of stores.
The same recipe, an unpatched controller left reachable by a third party, runs through the physical economy. Censys counts about 134,000 internet-exposed industrial control hosts worldwide, more than 40,000 in the U.S., and roughly 70% sit on mobile networks reached through cellular modems that vendors or integrators install. Researchers disclosed ten flaws in refrigeration controllers used in about two-thirds of U.S. grocery stores last year. Building HVAC, cold-chain warehouses, EV chargers and hospital equipment carry the same lifecycle and access gaps. The question is which sector is next.
The Impact on the OT Security Market
The OT sector was already hot prior to this new form of attack. In June, Accenture agreed to buy a majority of DataTribe’s portfolio company Dragos for about $4 billion. ServiceNow closed its $7.75 billion purchase of Armis in April, Claroty raised a $150 million Series F in January, and Mitsubishi Electric bought Nozomi Networks for about $1 billion. Yet those platforms were built for plants and utilities with dedicated OT teams, not stores with a contractor holding the keys.
Here’s what this means for the broader OT Security market:
- A larger TAM (Total Addressable Market). Retailers, food distributors and property owners now have a board-level reason to buy OT security, not just utilities and manufacturers.
- Regulation will follow the losses. France is investigating and U.S. agencies issued water-sector alerts in April and July; expect secure remote access and replacement of end-of-support equipment to move from optional to mandatory.
- Insurers will price physical consequences, creating demand for evidence of which OT exposures a policyholder carries.
- Detection alone is not enough. With 30% of industrial flaws unpatchable, spending will shift toward prediction, prevention and adversary emulation.
Reinforcement of our OT Thesis
Over the years, we have invested heavily in OT security because we believed the specialized physical infrastructure that powers our modern world would become cybersecurity’s most consequential battleground.
Dragos (detection and response) was DataTribe’s earliest investment; Accenture’s roughly $4 billion deal is the clearest validation our original thesis could receive. Frenos (prediction and prevention) and its zero-impact platform simulates attacks in live OT environments and pinpoints which combinations of techniques and vulnerabilities matter most, precisely the question an operator with unpatchable controllers must answer.
We continue to look for OT Security solutions that will build on attack simulation and provide new forms of ‘virtual patching’ and remediation for the kinds of ‘out of support’ systems that represent the greatest threat.
The bottom line
For a decade, security teams warned that unpatched, internet-reachable controllers would eventually cause physical harm at scale. On Monday, that warning became fires and spoiled food across hundreds of stores.
OT security now extends to any business with physical sites, and demand across detection, prediction and adversary emulation is about to accelerate.
