A fridge hack in France: what does it mean for a defense contractor's CMMC scope?

What happened in France?

The attackers went after the controllers that run store refrigeration, not the stores' office computers. Chains named in the reporting include Intermarché, Coopérative U and Super U, Carrefour, Monoprix and E.Leclerc. Store counts vary by source: Intermarché's owner, Les Mousquetaires, said about 150 of its stores were hit and Carrefour said about 80, according to The Register, while BleepingComputer cited French reports of 250 to 350 stores across chains. The Paris prosecutor's office has opened an investigation into what it called a large-scale cyberattack.

On October 12, CERT-FR, France's national computer emergency response team, published an alert reporting numerous compromises of Danfoss AK-SM and AK-SC refrigeration controllers. An October 13 update added Copeland and Dixell xweb devices. Its plainest line is the one to remember: exposing a management interface to the internet is contrary to good practice. Its first instruction was to take the units off the internet, or at minimum filter who can reach them. Danfoss told reporters the affected stores were running outdated firmware.

What is still unknown?

Who did it, and how they got in. Neither has been confirmed. CISA published an advisory on the Danfoss AK-SM 8xxA series (ICSA-25-140-03), and Claroty's Team82 researchers counted 2,765 internet-exposed AK-SM 800A devices. Neither finding has been confirmed as the way in this week. Intermarché told BleepingComputer the outage followed a cyberattack reportedly affecting a service provider that manages refrigeration in its stores.

That last detail is the one a defense shop should sit with. The equipment was not on anyone's IT list. It was maintained by an outside vendor, reachable from the internet so the vendor could troubleshoot it remotely, and running old firmware.

Do you have the same kind of equipment?

Almost certainly. Walk a 30 person machine shop and count the things with a network cable or a Wi-Fi chip that IT never bought:

• HVAC and building management controllers, often installed and serviced by the mechanical contractor.
• CNC machines, shop floor controllers and the PCs that feed them programs.
• Test and measurement equipment, such as coordinate measuring machines and spectrum analyzers.
• Security cameras and the recorder they write to.
• Badge readers and the door controller behind them.
• Anything a vendor reaches through a remote access box or a cloud portal so they can fix it without driving out.

How does CMMC Level 2 treat these devices?

The CMMC rule (32 CFR 170.19) sorts every asset into a category. Most of the equipment above fits the one called Specialized Assets: Internet of Things and industrial IoT devices (the rule's own examples include HVAC and fire detection), operational technology (industrial control systems, building management, physical access control, manufacturing systems), test equipment, government furnished equipment, and restricted information systems. These are assets that can touch CUI but cannot be fully secured the way a laptop can.

The good news is that a Specialized Asset is not tested against all 110 requirements. The work is documentation, and it is not optional. Each one has to be in your asset inventory, described in your System Security Plan as managed under your own risk based security policies and practices, and shown on the network diagram of your assessment scope. The assessor reviews the SSP for these assets. A device that never made the list is the problem, because nobody can show how it is managed.

The other honest option is separation. An asset can be out of scope only if it cannot process, store or transmit CUI and does not protect CUI assets, and it has to be physically or logically separated from them. If you put the building controllers on their own network, you must be ready to show the separation is real. A flat network where the HVAC box sits next to the engineering file server is not separated.

Which requirements does the French attack touch?

Several NIST SP 800-171 requirements speak directly to what went wrong, and an assessor will expect them to hold at the edge of your CUI environment:

• Boundary protection (SC.L1-3.13.1): monitor, control and protect communications at the external boundaries and key internal boundaries of your systems. A controller listening on the public internet is a boundary failure.
• Remote access (AC.L2-3.1.12): monitor and control remote access sessions. A vendor's always-on connection counts.
• Nonlocal maintenance (MA.L2-3.7.5): require multifactor authentication to establish maintenance sessions over external network connections, and end them when the work is done.
• External connections (AC.L1-3.1.20): verify and control or limit connections to and use of external systems, which includes a vendor's portal.
• Baselines and inventories (CM.L2-3.4.1): establish and maintain baseline configurations and inventories, including hardware, software and firmware. Firmware nobody tracks is firmware nobody updates.

What should you do this week?

1. Walk the building and list every networked device IT did not buy. HVAC, refrigeration, CNC, test equipment, cameras, recorders, badge readers, printers. Write down the make, model, firmware version, location and who services it.
2. Assign each one a CMMC asset category. Specialized Asset, out of scope with documented separation, or something more. Put the result in your asset inventory and your SSP.
3. Check what can be reached from the internet. Ask your IT provider for a list of open ports on your public IP addresses and what answers on each one. Any management page that answers from outside comes off the internet, or sits behind a VPN.
4. Ask every equipment vendor how they connect. Get it in writing: which tool, whether it is always on, whether it uses multifactor authentication, and who on their side can use it. Replace always-on access with sessions you start and end.
5. Put the devices on their own network. Separate building and shop floor equipment from the systems that handle CUI, and draw that separation on your network diagram.
6. Record firmware versions and ask about support. If the manufacturer no longer ships updates for a model, write that down and plan its isolation or replacement.

If you want a second pair of eyes on the list, our CMMC Level 2 gap assessment scores all 110 requirements and includes scoping, and the asset scoping worksheet gives you the inventory columns to start with. Or talk to us about your shop floor.

Sources

• CERT-FR alert CERTFR-2026-ALE-012, October 12, 2026, with an October 13 revision
• BleepingComputer, October 12, 2026, Cyberattack shuts down refrigerators at French supermarkets
• The Register, October 13, 2026, Cyberattacks crank French supermarket refrigeration systems up to 50°C
• The Hacker News, October 13, 2026, Attackers heat French supermarket fridges
• CISA advisory ICSA-25-140-03, Danfoss AK-SM 8xxA series
• Claroty Team82, Freeze the Controller, Defrost the Food