Latest / Tech Talks With Kinsoft / France's Supermarket Fridges - Overnight Defrost, Tens of Millions in Lost Stock, and the Controllers Exposed to the Internet

Transcript

France's Supermarket Fridges - Overnight Defrost, Tens of Millions in Lost Stock, and the Controllers Exposed to the Internet · Tech Talks With Kinsoft

• 0:00
  So, I want you to imagine grabbing a frozen pizza
• 0:03
  at your local supermarket. Right, just a normal
• 0:04
  Tuesday grocery run. Exactly, a totally normal
• 0:07
  Tuesday. You're reaching into the frozen food
• 0:09
  section, but instead of that familiar blast of
• 0:12
  arctic air hitting your face, the aisle is actually
• 0:15
  radiating heat. Which is just so wrong. Right.
• 0:19
  The glass on the freezer doors is, like, physically
• 0:21
  hot to the touch. And your first instinct is
• 0:24
  probably to assume some sort of localized malfunction,
• 0:26
  you know, like a blown compressor or a door left
• 0:28
  open. Sure. Just bad maintenance. Yeah. But the
• 0:31
  reality is far more sinister here. That warm
• 0:35
  freezer is actually the physical manifestation
• 0:37
  of a coordinated multinational cyber attack.
• 0:41
  It's wild. And, you know, we are witnessing a
• 0:44
  terrifying shift in the landscape of risk right
• 0:46
  now because for decades, cyber threats lived
• 0:49
  purely in the digital realm. Right. Like stealing
• 0:52
  passwords. Exactly. A hacker breached a server
• 0:54
  or encrypted your files, stole customer data.
• 0:58
  And the only physical sign was just an alert
• 1:00
  on a computer screen. But today we are crossing
• 1:02
  the Rubicon into literal physical destruction.
• 1:06
  Yeah, which is terrifying. It is. I mean, a line
• 1:08
  of malicious code can now manifest as melted
• 1:11
  plastic, spoiled food and actual combustion.
• 1:14
  And that physical bleed is our mission for today's
• 1:18
  deep dive. We are relying on a really fascinating
• 1:21
  transcript from an October 2026 IT and security
• 1:24
  show called Tech Talks with Kinsoft. Yeah, they
• 1:27
  did a great job breaking this down. They really
• 1:29
  did. They documented an event that completely
• 1:31
  paralyzed the French supermarket sector. And
• 1:34
  it really pulled back the curtain on this invisible,
• 1:38
  highly vulnerable infrastructure that runs our
• 1:41
  physical world. It's everywhere, yeah. So whether
• 1:43
  you are a tech novice or an IT pro, this is going
• 1:46
  to completely change how you look at the smart
• 1:48
  appliances in your home or office. Okay, let's
• 1:51
  unpack this timeline. Because overnight... Between
• 1:54
  Sunday, October 11th and Monday, October 12th,
• 1:57
  2026, refrigeration systems across France simply
• 2:01
  went rogue. Rogue is the perfect word for it.
• 2:04
  Right. And they didn't just shut down. They were
• 2:07
  weaponized. The controllers managing these units
• 2:10
  were remotely commanded into a state called continuous
• 2:14
  defrost mode. Yeah. And to grasp why that specific
• 2:17
  command is so devastating, we have to look at
• 2:20
  the actual mechanics of commercial cooling. Because
• 2:23
  defrost cycles are a built -in necessary feature.
• 2:28
  Wait, really? Yeah. A freezer has to defrost
• 2:30
  itself? Yeah, exactly. Because when a system
• 2:33
  constantly blasts sub -zero air, humidity in
• 2:36
  the environment causes this thick ice to build
• 2:38
  up on the internal evaporator coils. Okay, that
• 2:40
  makes sense. Right, and if that ice gets too
• 2:42
  thick, the fridge just stops working entirely.
• 2:45
  So to prevent this, the system is programmed
• 2:47
  to periodically activate a heating element. Oh,
• 2:49
  wow. Yeah, it's this short, really intense...
• 2:53
  bursts of thermal energy to melt the ice and
• 2:54
  then it immediately returns to its cooling cycle.
• 2:57
  So it's essentially a controlled temporary fever
• 2:59
  to keep the machine healthy. That is a great
• 3:01
  way to put it, yeah. But continuous defrost mode
• 3:04
  means that heating element is just locked in
• 3:06
  the on position while the compressor is still
• 3:09
  like desperately trying to cool the unit down
• 3:11
  at the same time. Fighting itself, basically.
• 3:13
  Yeah. It's like driving down the highway in the
• 3:15
  middle of summer with your air conditioning blasting,
• 3:16
  but your heated seats are turned up to the absolute
• 3:19
  maximum. Except here, you know, the materials
• 3:22
  involved are... Highly flammable. Right. And
• 3:25
  the resulting thermal runaway was staggering.
• 3:29
  I mean, French media began reporting that temperatures
• 3:31
  inside these commercial refrigeration units were
• 3:33
  hitting 50 degrees Celsius. Wait, 50 Celsius?
• 3:37
  Yeah. That is, let me think, that's 122 degrees
• 3:42
  Fahrenheit inside a sealed box that's designed
• 3:44
  to stay below freezing. Exactly. And now the
• 3:47
  Kinsoft report wisely cautions that we should...
• 3:49
  probably treat that 50 degree figure as a media
• 3:52
  report rather than like an audited scientific
• 3:54
  measurement. Sure, sure. The media loves a big
• 3:57
  number. Right. But the outcome is totally undeniable.
• 4:01
  The intense heat generated by these conflicting
• 4:03
  systems caused actual fires to break out in multiple
• 4:07
  stores across the country. Freezers catching
• 4:09
  on fire. I mean, the irony would be funny if
• 4:13
  it wasn't so incredibly dangerous. It's terrifying.
• 4:16
  Because a single store experiencing an electrical
• 4:18
  fire, that's a tragedy for that neighborhood.
• 4:19
  But this was a nationwide catastrophe hitting
• 4:23
  entirely different fierce corporate rivals simultaneously.
• 4:26
  Right. Which brings up a big question. If these
• 4:30
  grocery chains are bitter competitors who fiercely
• 4:33
  guard their own data and networks, how does one
• 4:36
  attack sweep across all of them at the exact
• 4:39
  same time? Well, they compete fiercely on branding
• 4:42
  and pricing and real estate, but they do not
• 4:45
  compete on the underlying mechanical architecture.
• 4:48
  They share the exact same hardware supply chains.
• 4:51
  Oh, I see. Yeah. And the scale of the victim
• 4:54
  list reveals this massive monoculture in supermarket
• 4:57
  infrastructure. I mean, you had Intermarché and
• 4:59
  its sister brand Netto suffering hits to anywhere
• 5:02
  from 150 to 300 stores. Cooperative U had around
• 5:06
  100 locations affected. Carrefour saw about...
• 5:10
  80 stores impacted. Monoprix lost functionality
• 5:13
  in about 5 % of its 490 stores. And Leclerc was
• 5:17
  struck as well. That is a staggering footprint.
• 5:20
  I mean, reports from Bleeping Computer placed
• 5:23
  the total at somewhere between 250 and 350 stores,
• 5:27
  while other outlets tracked it to over 500 locations.
• 5:30
  Yeah. Depending on who you ask, the numbers are
• 5:33
  huge. And the chaos wasn't even contained to
• 5:35
  France. Al Jazeera actually quoted a security
• 5:38
  analyst at Sequoia who noted that the disruption
• 5:41
  was bleeding across borders into Spain, Portugal,
• 5:45
  Poland, Germany, and Belgium. Which is a nightmare
• 5:49
  because the grocery business operates on notoriously
• 5:52
  razor -thin profit margins. pennies on the dollar.
• 5:55
  Right. So when Thierry Cotillard, who is the
• 5:58
  head of the parent group for Intermarché, when
• 6:00
  he went on television to assess the damage, he
• 6:02
  estimated single day losses in the tens of millions
• 6:06
  of euros nationwide. Tens of millions. Just gone.
• 6:10
  Because you're losing your entire inventory of
• 6:12
  fresh and frozen stock across hundreds of locations
• 6:15
  in a single night. That wipes out a quarter's
• 6:17
  profit instantly. Yeah. And it also triggers
• 6:20
  a massive national security response because.
• 6:23
  The food supply chain is critical infrastructure.
• 6:25
  The Paris prosecutor opened an immediate investigation
• 6:28
  into a large -scale attack on connected systems.
• 6:31
  They moved fast. They had to. The French Prime
• 6:34
  Minister, Sébastien Le Corny, ordered their national
• 6:36
  cybersecurity agency, ANSSI, to investigate.
• 6:40
  And the president of Cooperative U, Dominique
• 6:42
  Schelcher, publicly condemned the event as unprecedented
• 6:45
  and unacceptable. Which is totally fair. Yeah.
• 6:49
  And because the government and corporate response
• 6:51
  was so swift, the authorities actually quickly
• 6:53
  zeroed in on the hardware at the center of the
• 6:55
  meltdown. Right. The investigation pointed directly
• 6:58
  to a line of refrigeration controllers made by
• 7:00
  a Danish company called Danfoss, specifically
• 7:03
  the AK -SM8XXA series. Okay, so a specific controller
• 7:08
  box. Exactly. These controllers act as the central
• 7:11
  nervous system for the commercial freezers, and
• 7:13
  they are built with remote management interfaces.
• 7:16
  Oh, I see where this is going. Yep. This allows
• 7:19
  a technician or a supplier to basically log into
• 7:22
  the fridge's control panel over the Internet
• 7:24
  so they can monitor temperatures, tweak cooling
• 7:27
  cycles, and run diagnostics without having to
• 7:30
  dispatch a van and a mechanic to the physical
• 7:32
  store. Okay. I mean, I understand the economic
• 7:35
  incentive there, saving on gas and technician
• 7:38
  hours. But I want to push back on the fundamental
• 7:41
  premise here. Like, I get why my laptop needs
• 7:43
  a password, but why on earth does a supermarket
• 7:46
  freezer need an open Internet connection? Well,
• 7:49
  it's for that exact convenience. But Apple updates
• 7:52
  my phone while I sleep. Tesla pushes software
• 7:55
  updates to cars and driveways. If these Danfoss
• 7:58
  controllers are connected to the internet and
• 8:00
  vulnerable, why doesn't the manufacturer just
• 8:03
  force an over -the -air update to patch the open
• 8:05
  door? That is the big difference between consumer
• 8:07
  tech and industrial tech. It comes down to the
• 8:10
  catastrophic cost of a failed update. What do
• 8:13
  you mean? Well, if Apple pushes an update to
• 8:15
  your phone and it hangs on the reboot screen,
• 8:17
  You miss a few text messages, right? You do a
• 8:19
  hard reset and you're fine. Sure. But if a manufacturer
• 8:22
  forces a remote update to a commercial freezer
• 8:24
  controller and that system fails to reboot properly
• 8:27
  in the middle of the night. Oh, man. Exactly.
• 8:30
  $20 ,000 worth of meat spoils by morning. So
• 8:34
  in the industrial world, forced automatic updates
• 8:37
  are viewed as an absolutely unacceptable operational
• 8:40
  risk. Wow. Okay. So the updates are made available,
• 8:44
  but they require a human to manually initiate
• 8:46
  them. And humans, well, they often don't. They
• 8:50
  just ignore them. And the warning signs that
• 8:52
  these specific systems needed patching were flashing
• 8:54
  bright red long before October 2026. Like Danfoss
• 8:58
  had actually previously urged customers to update
• 9:01
  outdated firmware. Yeah, they tried to warn people.
• 9:03
  And CISA. the United States Cyber Agency, they
• 9:05
  had published a glaring advisory way back in
• 9:08
  2025 about an authentication bypass vulnerability
• 9:11
  in these exact controllers. That was CVE -2025
• 9:15
  -41450. And the mechanism of an authentication
• 9:19
  bypass is particularly insidious because, you
• 9:22
  know, people often picture hacking as a brute
• 9:24
  force attempt to guess a password, right? Like
• 9:26
  a computer trying millions of combinations until
• 9:29
  it gets in. Like in the movies, yeah. Right.
• 9:32
  But an authentication bypass means the system's
• 9:34
  software has a fundamental logical flaw. It's
• 9:37
  the equivalent of walking through the kitchen
• 9:39
  of a restaurant to completely bypass the bouncer
• 9:42
  at the front door. You just walk right around
• 9:43
  the security. Exactly. The system simply fails
• 9:46
  to ask you for your credentials if you route
• 9:48
  your request a specific way. And you add to that
• 9:51
  a separate command injection flaw disclosed by
• 9:54
  Danfoss, which was CVE -2025 -41451. Just piling
• 9:59
  up. And then a subsequent report by the security
• 10:02
  firm Clarity in August 2026 detailing how to
• 10:05
  achieve remote code execution on these exposed
• 10:07
  interfaces. The blueprint for disaster was fully
• 10:11
  published. Yeah. The exposure data cited in the
• 10:13
  Kinsoft dive is absolutely chilling. On the Monday
• 10:17
  of the attack, a researcher at Predictalab scanned
• 10:20
  the open Internet and found 2 ,752 of these Danfoss
• 10:25
  systems sitting completely exposed. Out in the
• 10:27
  open. Yeah. And over 1 ,500 of them were in France
• 10:31
  alone. Another scan using Shodan, which is a
• 10:35
  search engine specifically designed to find Internet
• 10:37
  -connected devices rather than websites, showed
• 10:40
  over 4 ,500 of these vulnerable controllers globally.
• 10:43
  What's fascinating here is that visibility is
• 10:46
  actually the most alarming aspect of this entire
• 10:49
  event. Because no specific advanced persistent
• 10:52
  threat or nation -state actor or sophisticated
• 10:55
  hacking syndicate has been named. Really? Nobody
• 10:58
  took credit? No. The Kinsoft report makes it
• 11:00
  clear there isn't even a confirmed link to a
• 11:03
  previous retail incident involving the Ahold
• 11:05
  Delhaize group. The barrier to entry for this
• 11:08
  attack was effectively zero. Wow. Anyone who
• 11:11
  read those public security bulletins and knew
• 11:13
  how to type a query into Shodan could have initiated
• 11:16
  this meltdown. This raises an important question,
• 11:18
  though. Right. Because if we step back from the
• 11:21
  burning freezers for a moment, this specific
• 11:24
  vulnerability feels like a symptom. of a much
• 11:27
  larger systemic disease in how modern businesses
• 11:31
  operate. Oh, absolutely. We are looking at a
• 11:34
  massive blind spot where the physical world meets
• 11:38
  the digital network. So what does this all mean?
• 11:41
  Well, we are confronting the dangerous divide
• 11:44
  between IT, information technology, and OT, operational
• 11:48
  technology. Okay, break that down for me. Think
• 11:50
  of IT as the nervous system of an organization.
• 11:53
  It's the laptops, the servers, the email flow.
• 11:56
  It handles data and signals. OT is the muscle.
• 12:00
  Operational technology manages physical processes.
• 12:03
  It's the hardware and software that actually
• 12:05
  moves or changes state in the real world. So
• 12:09
  not just fridges. Right. That includes these
• 12:12
  supermarket refrigeration controllers, but it
• 12:14
  also encompasses your building's HVAC system,
• 12:17
  the automated access panels that unlock the lobby
• 12:20
  doors, the industrial pumps in a water treatment
• 12:22
  facility, and the CCTV networks. And IT and OT,
• 12:26
  they operate under entirely different cultures,
• 12:29
  right? They rarely even talk to each other. Never.
• 12:31
  When a company buys a new fleet of laptops. The
• 12:34
  IT department subjects them to rigorous protocols.
• 12:37
  They install endpoint detection, enforce two
• 12:40
  -factor authentication, mandate complex passwords.
• 12:43
  But when that same company hires a mechanical
• 12:45
  contractor to install a new rooftop air conditioning
• 12:48
  unit, the IT sysadmin is completely out of the
• 12:51
  loop. Exactly. A trades contractor comes in,
• 12:55
  hoists the unit onto the roof, wires it up, and
• 12:57
  connects the management interface to the building's
• 12:59
  Wi -Fi so they can monitor it remotely and, you
• 13:02
  know, build a client for maintenance. Then they
• 13:04
  pack up their tools and leave. In the IT world,
• 13:07
  hardware is refreshed every three to five years
• 13:09
  and software is updated weekly. But in the OT
• 13:13
  world, the golden rule is if it is not broken,
• 13:16
  do not touch it. Just leave it alone. Right.
• 13:18
  A piece of operational technology is expected
• 13:20
  to run for 20 or 30 years without interference.
• 13:24
  The contractor leaves it running on the exact
• 13:26
  factory software it's shipped with. It's like
• 13:28
  the shadow IT of the physical world. I mean,
• 13:31
  a Fortune 500 company can spend millions of dollars
• 13:34
  a year on sophisticated email firewalls and mandatory
• 13:37
  employee phishing training only to have their
• 13:40
  entire operation compromised because an HVAC
• 13:42
  contractor hooked up a break room thermostat
• 13:44
  to the guest Wi -Fi and left the administrator
• 13:46
  password as admin. Yep. And the IT department
• 13:49
  is completely blind to it because that thermostat
• 13:51
  doesn't even show up on their corporate network
• 13:53
  map. If we connect this to the bigger picture,
• 13:56
  the paradigm of risk has permanently altered.
• 13:59
  For the last 20 years, a network breach meant
• 14:01
  a loss of confidentiality, right? Someone read
• 14:04
  your internal memos or stole a database of credit
• 14:06
  card numbers. But today, a network breach means
• 14:10
  physical kinetic damage. An attacker can turn
• 14:13
  off the oxygen monitors in a medical facility,
• 14:15
  disable the safety valves on a chemical pipeline,
• 14:17
  or override the thermal safeties on a supermarket
• 14:20
  freezer to intentionally start a fire. Okay,
• 14:22
  so if we have millions of these vulnerable, outdated
• 14:25
  devices permanently bolted into the ceilings
• 14:28
  and basements of our infrastructure, and we can't
• 14:30
  just unplug them without grinding commerce to
• 14:33
  a halt, what is the triage protocol? Right. How
• 14:36
  do we survive this? Exactly. And the Kinsoft
• 14:39
  Deep Dive transitions from this terrifying reality
• 14:41
  into a very pragmatic six -step survival playbook
• 14:45
  for securing the physical digital bleed. Let's
• 14:49
  look at the friction of actually implementing
• 14:50
  these steps. Step one is the inventory. Which
• 14:54
  is the cornerstone and, ironically, the most
• 14:57
  physically demanding part. Because you cannot
• 14:59
  secure what you do not know exists. Makes sense.
• 15:02
  This requires walking the physical site and logging
• 15:04
  every single device with a network cable or Wi
• 15:07
  -Fi connection that isn't a standard PC. Every
• 15:10
  smart light bulb, every security camera, every
• 15:12
  climate controller. And the real friction there
• 15:14
  is that these devices are actively hidden from
• 15:17
  you. They are shoved above ceiling tiles, locked
• 15:20
  in basement electrical closets, or mounted on
• 15:22
  roofs. You are essentially doing an archaeological
• 15:25
  dig to find hardware installed by a contractor
• 15:28
  who retired five years ago. Exactly. But it needs
• 15:31
  a human owner, right? You have to assign a human
• 15:34
  owner to every IP address. Step two is closing
• 15:38
  the doors. Right. If a vendor insists on having
• 15:41
  remote access to the equipment for maintenance,
• 15:43
  that management interface should never be reachable
• 15:46
  from the open internet. You don't leave the front
• 15:49
  door of your house wide open just in case the
• 15:51
  plumber needs to drop by while you're at work.
• 15:53
  Obviously not. So those interfaces must be placed
• 15:55
  behind a virtual private network or an allow
• 15:57
  list, meaning the firewall is configured to explicitly
• 16:00
  reject every single connection attempt except
• 16:03
  for the vendor's specific known IP address. Okay.
• 16:07
  Step three requires treating outdated firmware
• 16:09
  as a severe business liability, not just a trivial
• 16:12
  maintenance suggestion. You have to update the
• 16:15
  software or replace the hardware, which leads
• 16:18
  directly into step four, which is demanding patch
• 16:20
  commitments in writing. And vendors absolutely
• 16:23
  hate this, don't they? Oh, they despise it. Because
• 16:25
  maintaining and updating software code for 15
• 16:28
  or 20 years is incredibly expensive for a manufacturer.
• 16:31
  They would much rather sell you the box and wash
• 16:34
  their hands of it. Right. Just move on to the
• 16:36
  next sale. Yeah. So you have to force the issue
• 16:38
  during the procurement phase. When the contract
• 16:40
  is signed, it must include a legally binding
• 16:43
  commitment that the vendor will provide security
• 16:45
  patches for the entire operational lifespan of
• 16:48
  the device. If they refuse, you find another
• 16:51
  vendor. Okay, so those are the digital remedies.
• 16:53
  But step five is actually my favorite part of
• 16:55
  the playbook because it relies on a purely analog
• 16:58
  fallback. Here's where it gets really interesting.
• 17:01
  The recommendation is to install a cheap standalone
• 17:04
  temperature logger with an alarm that sends an
• 17:07
  SMS text message to your phone if the fridge
• 17:10
  gets too hot. It is brilliant. It's a wonderfully
• 17:13
  low -tech solution to an incredibly sophisticated
• 17:15
  threat. It completely bypasses the digital rot.
• 17:18
  Because if a highly skilled attacker compromises
• 17:21
  the million -dollar smart refrigeration system
• 17:24
  and alters the software so that the computer
• 17:26
  screen falsely displays a safe temperature...
• 17:28
  Right, they spoof the screen. Exactly. That $30
• 17:32
  dumb thermometer with a cellular chip is still
• 17:34
  going to text you and say, no, it is 50 degrees
• 17:36
  Celsius in here. It provides an independent,
• 17:39
  unhackable ground truth. That's amazing. Finally,
• 17:43
  step six is an administrative reality check.
• 17:46
  Reviewing your insurance policies. Because the
• 17:49
  gap between physical and digital coverage is
• 17:52
  a massive liability right now. A traditional
• 17:54
  cyber insurance policy will cover the costs of
• 17:56
  data recovery and IT forensics. but it frequently
• 17:59
  excludes physical property damage. And conversely,
• 18:02
  commercial property insurance often contains
• 18:04
  strict exclusions for damages originating from
• 18:07
  a computer network or a cyber event. Oh, wow.
• 18:10
  So you're just stuck in the middle. Yeah, it
• 18:13
  leaves a business completely stranded. So you
• 18:15
  need to explicitly demand clarity from your broker.
• 18:18
  Like, if a malicious line of code causes a freezer
• 18:21
  to burn down the store, ruining millions of euros
• 18:23
  in stock, is the physical spoilage and fire damage
• 18:26
  actually covered? That's a vital question. Because
• 18:29
  as the French supermarket chains learned, the
• 18:31
  financial devastation is identical whether the
• 18:33
  spark came from a faulty wire or an authentication
• 18:36
  bypass. Exactly. We started out looking at this
• 18:39
  bizarre incident of warm freezers in a grocery
• 18:42
  store. But following the breadcrumbs revealed
• 18:45
  a profound structural vulnerability in how we
• 18:48
  build the modern world. I mean, a digital command
• 18:50
  sent to a Danish controller caused physical fires
• 18:54
  and tens of millions in damages across rival
• 18:56
  corporate chains. Unbelievable. It forced the
• 18:59
  deeply hidden world of operational technology
• 19:01
  into the spotlight, proving that the gap between
• 19:04
  the IT department and the physical building has
• 19:07
  vanished entirely. It has. And I want to leave
• 19:10
  you with a final unsettling thought to process
• 19:13
  as you navigate the physical infrastructure around
• 19:15
  you. As our buildings, supply chains, and environments
• 19:18
  become aggressively smart, we are quietly handing
• 19:22
  over the physical safety of our reality. to the
• 19:25
  password hygiene of random installation contractors.
• 19:28
  Wow. Yeah. We are trusting our physical well
• 19:31
  -being to software that was installed a decade
• 19:33
  ago and never updated. So if the line between
• 19:36
  a digital network breach and physical arson has
• 19:39
  truly been erased, how long is it until a physical
• 19:42
  security guard needs a computer science degree
• 19:44
  just to safely patrol a building? That is a wild
• 19:48
  thought. Next time you're reaching into the frozen
• 19:50
  food aisle... You are definitely going to look
• 19:52
  at that blinking digital temperature display
• 19:54
  in a whole new light. Thank you for joining us
• 19:56
  on this deep dive. Keep questioning the connected
• 19:59
  infrastructure around you, and we will catch
• 20:02
  you next time.