Refrigeration cyberattack: Which dependencies put your operations at risk?

A business can protect its office IT and still overlook a critical dependency: the controller of an installation maintained by an external provider. The current incident in France makes that question tangible. Do you know the systems and access paths your operations actually depend on?

TL;DR: What to check today

• Look beyond servers: Include operationally critical installations and their controllers in your inventory.
• Assign remote access: Record which provider administers which system through which access path.
• Assess the impact: Determine with the business team what happens during an outage and when the damage becomes unacceptable.
• Close the loop: Every finding needs an owner, a deadline and verifiable evidence.

As of 13 October 2026. Confirmed reporting and our recommendations are separated below. The cover is an AI-generated illustration, not a photograph of the incident.

What has been confirmed

French supermarket refrigeration systems were attacked overnight on 11–12 October. On 13 October, Le Monde reports stock losses and operational disruption. Read the news report.

CERT-FR confirms numerous compromised Danfoss AK-SM and AK-SC controllers. It recommends disconnecting or filtering access and lists recovery steps for suspected compromise. Changes to running installations belong with the responsible operations and security teams.

This warning does not establish the specific vulnerability exploited, the attacker or whether all affected installations shared an attack path. Danfoss publishes product- and version-specific security advisories. Their existence alone does not demonstrate a connection to this incident.

The question for your business: What depends on what?

Our interpretation: A device list alone does not answer the business question. You need to identify which process depends on which asset and which provider.

This applies beyond food retail. Production controls, building automation and essential technical utilities are examples of scenarios to assess in your own business. We are not claiming additional victims of this attack; we are applying the dependency question to other organisations.

For each critical asset, record its purpose, location, business process, operational owner, maintenance partner and access paths. Add support status and the source of that information. “The provider takes care of it” is insufficient without ownership and agreed scope.

Five questions for IT, operations and procurement

This table is our practical worksheet, not an official checklist. Use it for a joint review.

Question	What to record	Who can provide the answer
Which installation cannot fail?	Process, asset and specific consequences	Business team and operational owner
Who has remote access?	Provider, access path, permissions and ownership	IT and maintenance partner
Who keeps the system current?	Support status, update ownership and maintenance window	Operations and supplier
What do we do during disruption?	Escalation contact, fallback procedure and restart	Process owner and continuity team
How do we verify completed work?	Action, deadline, evidence and review	Action owner

A BIA turns “critical” into a decision

Rating an asset “high” does not tell you how long its process can remain unavailable. A business impact analysis (BIA) considers the consequences of disruption over time and the prerequisites for recovery.

Fictional example: A business needs refrigerated storage. Its operations team assesses when goods would become unusable, what alternative capacity exists and what must happen before restarting. Temperature limits and permissible interruptions must come from that particular operation; we do not invent universal values.

Processes and BIA in Kopexa help you keep these assessments connected to required resources and responsibilities. The result is a reasoned priority: Which dependency needs attention first?

Supplier assessment should lead to action

An assessment is useful when its findings become concrete work. Ask your maintenance provider about responsibility for access, updates and escalation. Check responses and evidence against your actual installation and agreed service scope.

Kopexa can send questionnaires and reminders automatically. Answers can feed risk ratings according to configured rules. An automatically calculated score does not replace assessment of a specific operational risk. Unclear answers or missing evidence should trigger follow-up and actions.

Vendor management and vendor assessments connect this work to the provider. Nested supplier chains also help document further known dependencies.

From finding to verified implementation

An action needs a clear outcome rather than “check remote maintenance”. Our fictional example:

• Finding: Maintenance access paths and ownership are undocumented.
• Action: Operations, IT and the maintenance provider agree and document the access procedure.
• Outcome: A named owner, confirmed service scope and traceable access process are available.
• Review: A responsible person reviews the evidence; outstanding items remain visible.

This turns a news story into a reason to improve your own operations. Risk management brings impact, treatment and evidence together. An ISMS gives the work a recurring framework instead of relying on headlines to trigger attention.

Your next step

Choose one critical process and work through the five questions with the relevant teams. The important outcome is being able to assign and follow up on outstanding work.

If your answers currently live in separate spreadsheets and inboxes, Kopexa vendor management shows how to coordinate assessments, risks and actions in context. Explore one such workflow in a personal demo. Kopexa supports implementation and evidence management; it does not provide technical protection for installations or replace incident response.