GoKawiilIPinfo scans show French supermarket fridge controllers were exposed online for months before October attack
After an October 11-12, 2026 cyberattack forced refrigeration units in hundreds of French supermarkets into defrost mode—causing some to reach 50°C and ignite—internet scanning firm IPinfo examined historical data on exposed fridge control dashboards. It found France had 1,331 exposed dashboards, more than the rest of the world combined, with 85% running software containing known vulnerabilities, including 527 units no longer supported by maker Danfoss. Most of these dashboards had sat at the same internet address for at least six months before the attack, and only a minority were fully patched.
GoKawiil's interpretation of the reporting above, not reported fact.
The data suggests the attack's scale in France stemmed less from worse security practices than from sheer exposure—France simply had far more of these industrial control dashboards reachable from the internet, since other countries had a nearly identical rate of unpatched systems. This points to a broader pattern where operational technology, like refrigeration controllers, is often left online and unmonitored for long stretches, creating opportunities for attackers regardless of a single country's cybersecurity diligence. The drop to 316 exposed dashboards after the attack indicates operators moved quickly to pull systems offline once the risk became visible.
- France had 1,331 exposed fridge control dashboards before the attack, more than all other 72 countries combined.
- 85% of France's exposed systems had known security flaws, including 527 controllers no longer supported by Danfoss.
- Most dashboards had been exposed for six months or more, and only a quarter were fully updated by the time of the attack.
Source: ipinfo.io, 2026-10-20
Published there as: “France's supermarket fridges were vulnerable online for months”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.