On the night of Sunday, October 11, someone reached the refrigeration systems of hundreds of supermarkets in France over the internet and left them heating until morning. They didn’t take a single record. They didn’t ask for a ransom, as far as anyone knows. They spoiled food. Tons of it.
Today Radio Bío Bío, here in Chile, invited me on air to talk about the case. While preparing, something clicked: the interesting part isn’t in France. I’ve seen this same thing before, at a smaller scale, in security cameras, in home networks and even in cars.
Here’s the conclusion up front: it wasn’t magic. It was maintenance nobody did.
What happened
According to Bío Bío’s coverage (in Spanish) and the security press, the attackers took over the controllers that run the fridges and freezers. They are panels made by the Danish company Danfoss, one per store, which maintenance contractors operate remotely.
What they did is almost elegant in how simple it is. They switched on the defrost cycle, a normal feature of the equipment, and never switched it off. Some units reached 50 °C (122 °F). The chains affected include Intermarché, Carrefour and E.Leclerc. The numbers still don’t match between outlets, so I’ll stick with “hundreds of stores”.
Three things are worth saying carefully, because the investigation has barely started:
- Nobody knows who did it or why. No one has claimed it.
- The exact entry point is not confirmed. What the manufacturer did say is that the affected units were mostly older products or current products running outdated firmware, and that they should be taken off direct internet exposure.
- There is no evidence that AI was used. The French press describes it as an opportunistic attack.
Firmware, or why it’s never just one device
Firmware is the software that ships inside a device and makes it work. It’s the operating system of the fridge, the router, the camera. You never see it, and almost nobody updates it.
The key point is this: every device of the same model and version has exactly the same flaw. Whoever learns to open one knows how to open them all.
Picture a building where every apartment has the same lock, and one day someone publishes how to copy the key. The manufacturer warns everyone and hands out the new lock for free, but nobody installs it. That’s outdated firmware.
In this case Danfoss had published patches more than a year ago for flaws that allowed authentication to be bypassed. And a researcher counted thousands of these panels visible from the internet that same Monday. There are public search engines for connected devices that list them by brand and model. The attacker doesn’t hunt for victims. They filter a list.
One nuance matters here. “Just update” isn’t always enough: some of these units were already out of support, with no new patches coming. For those, the only options are to cut them off from the internet or replace them.
I’ve seen this before: cameras, homes and cars
None of this is unique to supermarkets. And I can tell you first-hand: it isn’t theory.
Security cameras. I’ve reviewed camera and recorder systems, many of them Chinese-made, installed years ago and never touched again: factory firmware, default password, and the admin panel open to the internet so the owner can watch from their phone. The same recipe as in France. The device you bought to feel safer ends up being the way in.
Your home network. The real risk isn’t someone watching your camera. It’s that a compromised device sits inside your network, next to your computer, your phone and your backups. From there, everything else is visible and reachable. A stranger’s machine inside your network is a far more serious problem than a leaked password.
Something eye-opening happened to me while setting up Home Assistant, the home automation system. The first thing it does is show you every device it finds in your house. The list is always longer than you expect: TVs, smart plugs, speakers, things you’d forgotten you ever connected. If a home tool finds them in seconds, so will anyone who gets into your network.
Cars. Modern cars are computers on wheels, connected to the manufacturer’s servers. Security researchers have shown more than once that a vehicle can be identified and some of its functions taken over by bypassing authentication: in 2015 with a Jeep on the highway, and in 2024 with a Kia portal where a license plate was enough. Those were responsible disclosures and the flaws were fixed, but they show the pattern repeats.
Where AI comes in
To repeat what I said above: nothing suggests AI was used in France. My point is a different one, and it’s about the trend.
A few years ago, turning a published patch into a working attack took a specialist and several weeks. Today someone with average skills, helped by an AI model, can read the patch, understand what it fixed and write the tool in hours. AI didn’t invent new attacks. It made the existing ones cheap.
The data backs this up. According to Mandiant, in 2018 it took an average of 63 days from a flaw being published to it being exploited; today that average is negative: flaws are exploited before the patch exists.
Not all models are equal here. The big labs, like OpenAI and Anthropic, invest in detecting and blocking malicious use, and they publish reports when they find their own models being abused. People still use them to attack; the difference is that someone is watching and can shut the account down. An open-weights model, on the other hand, can be downloaded and run on your own machine, with no provider seeing what it’s asked, and its safeguards can be stripped out. Several of the most capable open models today are Chinese, but the country isn’t the problem: the same goes for models from Meta or Google. It’s a matter of design.
And this very week Anthropic published a lab study projecting that small models could be months away from copying themselves onto cheap connected devices. It’s a controlled test, with limitations the authors themselves spell out. But it points at exactly the kind of equipment we’re talking about.
The conclusion is uncomfortable and simple. If attacking got cheaper, defending badly got more expensive. It used to take a team. Now it takes one curious person with an internet connection. The bar has to go up, and not because anyone feels like it.
And in Chile, how are we doing?
The same. You don’t need to go to France to see it.
Stand for a while in Costanera Center, the biggest mall in Santiago, turn on your phone’s Bluetooth and wifi and look at the list. Cars, access points, TVs, speakers, watches. Piles of devices announcing themselves to anyone who cares to look. Who’s looking after what? In most cases, nobody.
Homes are no different. Security cameras are the example I see most often: I’ve lost count of the cameras I’ve found running on the password they shipped with.
My view is that the baseline needs an update. What was “good practice” until yesterday is now the floor. And that floor should include, by default, running a basic AI analysis over what you own: your network, your website, your devices.
AI is being used against you. Use it yourself. That alone probably covers 90% of what anyone could find on you with the same tool.
What I’d do today
At home:
- Take inventory. Log into your router, or use something like Home Assistant, and see what’s connected. Whatever you don’t recognize goes.
- Change the factory passwords on everything that connects: router, cameras, recorders, TVs.
- Turn on automatic updates wherever they exist.
- Split your networks. Gadgets go on the guest wifi, away from your computer and phone.
- If the manufacturer no longer updates it, replace it or take it off the internet.
In a business, on top of that:
- No admin panel directly on the internet. Remote access only through a VPN with two-factor authentication.
- Review the contract with whoever maintains your equipment: who updates it, how they get in, and who answers when it fails.
- Have an alarm that’s independent of the system it watches. In France, some stores saved their stock because a temperature alert reached them in time.
- Give patching an owner and a calendar, just like elevator maintenance.
To wrap up
I think this is going to grow. France was a massive case, and it came to light. But what makes the news today will become more common every day, and much of it will never reach a headline.
The obligation sits with whoever is responsible for business continuity and cybersecurity, and it starts much earlier: at the foundation of development. High standards of quality, auditing, and independent verification: the person who checks shouldn’t be the one who built it or the one who maintains it. A control that’s isolated from the system it watches, like that temperature alarm that saved some stores.
The attacker doesn’t pick you. They pick a device model, and you’re on the list.
So the question for this week isn’t what happened in France. It’s shorter: who in your home, or in your company, knows which version is running on that device you have connected to the internet?