When the Fridge Becomes a Heater: The French Cyberattack and India's Blind Spot in Operational Technology

The Attackers Didn't Add Heat. They Kept a Safety Feature Switched On.

What the

attackers actually did Every commercial freezer has a heater inside it. That sounds odd, but it is how defrosting works. Ice builds up on the cooling coils, so for a short spell each day, roughly two hours under normal operation, small heaters switch on to melt it, then switch off.

The attackers did not need to invent a weapon. They broke into the software that controls these cycles and kept the heaters running. The same feature that protects the freezer turned it into an oven. Temperatures climbed to 50°C, at Intermarché stores for six hours.

Food was thrown away and some stores caught fire. The analogy has a limit. A freezer with its defrost stuck on is a fault. Hundreds of freezers doing it at once, across rival chains, at night, is an attack. What made the difference was a single point of control.

One supplier, hundreds of stores ANSSI, France's cybersecurity agency, traced the attack to a vulnerability in refrigeration-management software supplied by Danfoss.

Reports point to legacy controllers in the AK-SM 8xxA series and older AK-SC models. Danfoss had already published an advisory for this controller family, warning of an operating-system command-injection risk and urging users to upgrade firmware and restrict external access.

Researchers had earlier reported ways to bypass authentication in the same systems. So this was not a sophisticated new technique. It was a known weakness, sitting in unpatched devices exposed to the internet. Because one vendor's software ran in Intermarché, Carrefour and Coopérative U stores alike, one weakness reached all of them.

That is the defining feature of a supply-chain attack: you do not need to break into hundreds of companies, only the one they all trust.

Where

India stands India's legal framework was built mainly for information technology. Section 70 of the IT Act, 2000 protects Critical Information Infrastructure - systems whose disruption would harm national security, the economy or public health - through the NCIIPC.

A supermarket's refrigeration controller would not normally be designated as CII. CERT-In's 2022 directions require companies to report serious cyber incidents within 6 hours. That is useful, but it acts after the breach.

On devices, standards are emerging. The Telecommunication Engineering Centre notifies technical standards under the Telecommunications Act, 2023, including one for IoT gateways and BIS has a data privacy assurance standard.

India has no equivalent yet of the EU's Cyber Resilience Act, which places secure-by-design obligations on manufacturers. Its vulnerability-reporting requirements began applying in September 2026, with full compliance due by December 2027.

That is the gap that matters for India's expanding cold chain and smart retail. The weak point is no longer only the bank or the power grid. It is the thousands of connected controllers in warehouses, pharmacies and stores.

India's rules mostly govern how fast a breach is reported, not whether the device was built to resist one. For the examiner, the lesson is that cybersecurity now has two layers: protecting data and protecting the machines that data controls.

A modern strategy needs both.