Most conversations about connected device risk start with cameras, door controllers, and badge readers. This week, the conversation started with refrigerators.
On October 12, several of France's largest grocery chains confirmed that attackers had remotely altered the refrigeration systems in hundreds of stores. Fresh and frozen inventory had to be thrown out, and prosecutors say some stores had fires. The devices involved were not servers or laptops. They were refrigeration controllers, many of them older models that no longer receive security updates.
If your organization runs connected devices that sit outside traditional IT, this incident is worth a close look.
Overnight on October 11, attackers exploited a vulnerability in refrigeration control software and remotely forced defrost cycles across hundreds of stores run by Intermarché, Coopérative U, E.Leclerc, Carrefour, and others (CBS News/AFP). Most of the affected controllers were legacy models that no longer receive security updates. French authorities have opened an investigation and are alerting other European countries that may run the same equipment.
The financial impact is still being tallied, but early figures are significant:
Tens of millions of euros in one day. That is how Intermarché's CEO described nationwide losses in an interview with BFM TV (CNN).
Several million euros for one group. Les Mousquetaires, which runs Intermarché and Netto, told TIME its own losses could reach that level (TIME).
€270,000 at two stores. An Intermarché and a Super U in Haguenau reported that much in lost merchandise between them (Infosecurity Magazine).
The operational impact went beyond spoiled stock. Temperatures in some units reportedly reached 50°C, fires broke out at several stores, frozen food aisles were closed, and teams had to bring in refrigeration specialists to restore service. Those figures do not yet include restocking, equipment replacement, or lost sales while aisles were empty.
Refrigeration controllers have a lot in common with the cameras, NVRs, access control panels, and intercoms most enterprises run. They run vendor firmware, they are deployed across many sites, and they often stay in service long after the vendor stops supporting them. That profile creates two distinct risks.
1. Operational damage. These devices control physical outcomes. Compromise a refrigeration controller and food spoils. Compromise a camera system and you lose coverage. Compromise an access control panel and doors stop working as intended. The French attack showed that one vulnerable model, deployed widely, can cause damage at hundreds of sites at once.
2. A way into the network. Connected devices are also entry points. They are often less monitored than servers and endpoints, they frequently run outdated firmware or default credentials, and they sit on networks that connect to other systems. Once inside, an attacker can move laterally toward more valuable targets. Major retail breaches have started this way, including one that began with credentials stolen from an HVAC contractor and grew into a much larger incident.
The first risk shows up immediately. The second may not show up until much later.
There is no public indication yet of how the French attack was carried out. What is clear is that attacks like it are getting easier.
In June, the cybersecurity agencies of the US, UK, Canada, Australia, and New Zealand issued a joint statement warning that AI lowers the barrier for attackers and shortens the time between a vulnerability being discovered and being exploited. Tasks that once required specialized skill, such as scanning for exposed devices and developing exploits, are increasingly automated (Cloud Security Alliance).
For connected devices, that matters. Large fleets of identical models, running known-vulnerable firmware that will never be patched, are exactly the kind of target that automation makes cheaper to find and exploit at scale.
In most organizations, the team that depends on a device is not the team that patches IT systems. Store operations owns refrigeration. Physical security owns cameras and access control. Facilities owns building systems. IT and cybersecurity provide network access, policy, and oversight, but they rarely have the device knowledge or the tools to maintain specialized hardware day to day.
That structure is reasonable. The risk comes when the device owner has no practical way to see firmware status, track end-of-life dates, or act on a vulnerability across every site. Legacy devices stay in place because replacement is costly and nothing appears to be wrong, until something is.
Whether you manage cameras, access control, or other connected building devices, a few questions are worth answering this week:
Do you have a complete inventory? You need every device, its model, its firmware version, and its location, across every site.
Which devices are past end of support? Devices that no longer receive security updates need a replacement plan or compensating controls such as network segmentation.
Can you act on a new vulnerability quickly? When a CVE is published for a model you run, you should be able to identify every affected unit and update it without a site visit to each one.
Are credentials and remote access controlled? Default passwords and open remote management interfaces are common entry points.
Is ownership clear? The device owner should have the visibility to maintain the device, with IT and cybersecurity aligned on policy and escalation.
The devices that keep stores, campuses, and facilities running are now a target in their own right and a path to everything else on the network. Firmware does not update itself, and end-of-life hardware does not retire itself.
SecuriThings has long helped physical security teams see and manage their cameras, access control, and related devices at scale. The platform now extends that same visibility and automation to enterprise IoT devices beyond physical security, so the teams that own those devices can track firmware, credentials, and end-of-life status across sites and vendors, and act on new vulnerabilities quickly.
If you want to get out in front of this fast-growing risk, request a SecuriThings Platform Preview where you can get an no-obligation analysis of the current risk areas of your IoT device fleet, and can get a feel for how SecuriThings can help you take a more proactive security posture.