Connected equipment security matters more than most business owners realize, because a single compromised controller can destroy inventory, spark fires, or shut down operations overnight. Hackers proved this by remotely heating refrigerators and freezers at hundreds of French supermarkets to 50 degrees Celsius, causing fires and forcing stores to throw out entire cold-storage inventories.
What happened in the French supermarket attack?
The Paris prosecutor’s office described a large-scale attack affecting connected refrigerators at several major food retailers across France, leading to food losses and fires. Les Mousquetaires, owner of retailer Intermarché, said fridges at around 150 of its stores were heated to 50 degrees Celsius overnight for six hours. A spokesperson confirmed all affected food had been discarded to eliminate health risks.
Carrefour reported 80 of its supermarkets were hit. Monoprix, which operates about 490 stores in France, said 5 percent of its stores were affected. A Paris resident witnessed staff at an Intermarché in central Paris throw cartfuls of defrosted frozen food into a giant trash container, with molten ice cream sloshing out of broken tubs onto the street.
Prime Minister Sebastien Lecornu instructed France’s National Cybersecurity Agency (ANSSI) to investigate. French authorities said they were coordinating with European counterparts because other countries could also be affected, and were assessing whether other French companies were at risk. A senior cyber threat intelligence analyst at Sekoia Threat Detection and Research said Spain, Portugal, Poland, Germany, and Belgium had also been affected.
Why does connected equipment security matter for your business?
Most SMBs think of cybersecurity as protecting files and email. But any piece of equipment with an internet connection becomes a potential entry point for attackers who want to cause physical damage, not just steal data.
Picture a machine shop where HVAC controls maintain precise temperature and humidity for sensitive equipment. An attacker who gains access to those controls could ruin materials, damage machinery, or create unsafe working conditions. The same logic applies to refrigeration in food service, environmental controls in healthcare facilities, or building-access systems in professional offices.
The French attack demonstrates that operational technology attacks are not theoretical. These systems often run on outdated firmware, use default passwords, and sit outside the monitoring tools your IT provider watches. They connect to the internet for remote management and efficiency monitoring, which makes them accessible to anyone who finds the right vulnerability or credential.
What makes operational equipment vulnerable to attack?
Most connected operational equipment was designed for convenience and cost, not security. Vendors prioritize ease of installation and remote access over authentication controls or encryption. Many systems ship with factory-default credentials that installers never change. Some have no patching mechanism at all, leaving known vulnerabilities open for years.
These devices rarely appear in your asset inventory. The HVAC contractor installed them, the building owner manages them, or they came with the facility when you moved in. Nobody thinks of them as IT assets until an attacker uses them to cause real-world damage.
When equipment connects to the internet for cloud dashboards or remote diagnostics, it becomes part of your attack surface. An attacker who finds one exposed device can often move laterally to others on the same network. In the French case, once attackers compromised the refrigeration control system, they could adjust temperatures across hundreds of locations.
How should SMBs approach connected equipment security now?
Start with an inventory. Walk your facility and list every piece of equipment that has an Ethernet port, Wi-Fi antenna, or cellular modem. Include HVAC, access control, cameras, printers, refrigeration, environmental monitors, and manufacturing equipment. Ask your vendors which devices phone home and what networks they use.
Segment operational equipment onto separate network VLANs that cannot reach your business data or communicate directly with the internet. Require any remote-access connections to route through a VPN with multifactor authentication. Disable or remove default accounts, and require strong passwords on every interface.
Check with each vendor about firmware updates and security patches. Many operational-technology vendors issue updates infrequently or not at all. If a device cannot be patched, consider replacing it or isolating it completely. Monitor logs and network traffic for anomalies, especially connections to unfamiliar external IP addresses.
Include operational equipment in your incident-response plan. If an attacker heats your refrigeration or shuts off your HVAC, you need a manual override process, contact numbers for vendors, and a communication plan for customers or patients who may be affected. Test those procedures before you need them.
What questions should you ask your vendors and installers?
Before purchasing or deploying any connected equipment, ask the vendor how the device authenticates, whether it requires internet access, and how often security updates are released. Ask whether the device can operate in a network-isolated mode and what functionality you lose if you disable cloud features.
For equipment already installed, ask your service providers which default credentials are still active, what ports are open, and whether remote access is enabled. Request a copy of the device configuration and review it with your IT provider or managed-service partner. Many building-automation and refrigeration contractors are not thinking about cybersecurity, so you need to ask the questions explicitly.
If the vendor cannot answer basic security questions or refuses to disable unnecessary remote features, treat that as a red flag. Operational equipment often remains in service for a decade or more, so a poor security posture today becomes a growing liability.
Who is responsible for protecting connected operational equipment?
Responsibility usually falls between IT, facilities, and vendors, which means nobody owns it. Your IT provider may not know the HVAC system is on the network. Your facilities manager may not realize the building-access controller can be hacked. The vendor who installed the equipment probably left remote access enabled and moved on.
Assign a single point of accountability. In most SMBs, that means your IT lead or managed-service provider should inventory, monitor, and secure all network-connected devices, regardless of who installed them. Include operational equipment in your regular security reviews and audit processes.
If your business operates under regulatory frameworks (HIPAA for healthcare, CMMC for defense contractors, or state data-breach laws), understand that attackers who compromise operational equipment may gain access to business data or disrupt services in ways that trigger notification and liability requirements. A data breach caused by an operational-technology attack still counts as a breach.
What does the French attack mean for SMBs in the U.S.?
The same categories of equipment exist in U.S. businesses. Refrigeration systems in restaurants and food distributors, HVAC in offices and manufacturing plants, access-control systems in professional-services firms, and environmental monitors in healthcare facilities all connect to the internet and run similar software.
Attackers are increasingly targeting operational technology because it offers direct business impact with less mature defenses. Heating a refrigerator or shutting off climate control creates immediate visible damage, which can be more valuable to ransomware actors than encrypting files. It also bypasses traditional endpoint-security tools, which do not run on most operational devices.
Small and mid-sized businesses are attractive targets because they often lack the segmentation, monitoring, and vendor-management processes that larger enterprises have built. An attacker who finds one vulnerable device can test and refine techniques before moving to larger targets. Manufacturers and professional-services firms with connected operational equipment need to treat those systems with the same rigor they apply to laptops and servers.
Frequently asked questions about connected equipment security
Do internet-connected HVAC and refrigeration systems create cybersecurity risks?
Yes. Any equipment with internet connectivity can be accessed remotely by attackers if it is not properly secured. The French supermarket attack demonstrated that hackers can manipulate refrigeration systems to cause fires and destroy inventory. HVAC, building controls, and other operational equipment often run outdated firmware and lack strong authentication, making them easier targets than traditional IT systems.
How can I tell if my operational equipment is vulnerable?
Start by identifying every device connected to your network, including HVAC controllers, access systems, cameras, and refrigeration monitors. Check whether they use default passwords, require internet access, or allow remote login. Ask vendors about patch schedules and known vulnerabilities. If a device cannot be updated or isolated, it represents ongoing risk.
Who is responsible for securing building systems and operational technology?
Responsibility often falls between IT, facilities, and third-party vendors, which creates gaps. Best practice is to assign your IT lead or managed-service provider accountability for all network-connected devices, regardless of who installed them. Include operational equipment in asset inventories, security audits, and incident-response plans.
Should operational equipment be on the same network as business computers?
No. Operational equipment should be segmented onto separate VLANs with restricted access to business data and the internet. This limits lateral movement if an attacker compromises one device. Remote access should require VPN connections with multifactor authentication, and default internet connectivity should be disabled unless absolutely necessary.
What should I do if my vendor says a device must connect to the cloud?
Ask what functionality requires cloud access and whether it can operate in a local-only mode. Request documentation on encryption, authentication, and patch processes. If the vendor cannot provide satisfactory answers or refuses to disable unnecessary features, consider alternative products or additional network controls. Many cloud-connected devices offer little operational benefit but significant security risk.
Keep reading
Sources
Source: Hackers heat French supermarket fridges, sparking fires, spoiling food
Researched and drafted with AI, then reviewed and approved by Ron Trotto before publishing.