On the night of 11 October, attackers reached into the refrigeration controllers of supermarkets in France and switched them into a defrost cycle with the food still inside. Reports say temperatures climbed rapidly, stock was thrown away, and up to 700 stores were affected. Similar weaknesses have since been found in other European countries. Nobody has yet been identified as responsible.
No customer data was stolen. This was an attack on the physical building.
What went wrong
According to the reports, the controllers had web interfaces that could be reached from the internet. Some accepted a default-style login. A software fix had been issued in 2025, but not every unit had it, and some units were too old to be supported at all. Nothing alerted staff overnight.
None of that is exotic. It is the same pattern we see across building systems: equipment installed by one team, owned by facilities, and unseen by IT. Each side assumes the other has it covered.
Four questions worth asking about your own site
Can any building or plant controller (refrigeration, HVAC, lighting, access) be reached from the internet?
Does it still use a default or shared login?
Is the firmware current, and is the product still supported by its manufacturer?
If something goes wrong, is there an alarm that doesn’t depend on the same network?
If you can’t answer all four with confidence, that’s the place to start.
Where CMC fits
We are trained in both the systems and the cyber, so we look at a building the way an installer does and the way an attacker would. A review before installation catches the exposure at design stage. A review after handover finds what changed along the way.
Before systems go in and after they go live.
We covered how building controllers become an entry point, and why legacy protocols like BACnet, KNX and Modbus leave them exposed, in Episode 3 of our Known Systems, Hidden Risks series, below.
Known Systems. Hidden Risks. | Episode 3 - Modern Building Control Protocols
Understanding BACnet, KNX and MODBUS - and the Cybersecurity Risks Emerging Behind Them