decrypted · 11 november 2026 · vulnerabilities and patching · ai and llm security

A supermarket thermostat on the open internet became a national incident

In October, someone reached into the controllers that run supermarket refrigeration in France and told them to defrost. This week France named who it believes was behind it, and a second wave has already hit more than 115 stores across six European countries. The lesson for UK directors is simple: a thermostat became a national incident because it was reachable from the public internet.

What happened

BleepingComputer reports that about 700 French retail locations were targeted overnight on 11 and 12 October, with at least 15 fires and food losses in the tens of millions of euros. Attackers compromised Danfoss controllers and remotely set the defrost cycle to high temperatures. On Monday France's cyber crisis coordination centre attributed those attacks to units inside Iran's Revolutionary Guard cyber centre, citing shared infrastructure, Farsi-language traces and the use of FOFA, a search engine for internet-connected devices. France attributed only the October attacks, not the November wave.

That wave began on 2 November. A Swedish ICA store reported its setting jumping to +50°C and refusing to change. The refrigeration firm Sabcobel said the same vulnerability was used as in France.

A cold room with a doorbell

Picture a cold room whose control panel is bolted to the outside wall, with a sign saying "knock". Now add a directory of every such panel in Europe. The attacker never needs to find you; they look you up.

CISA, America's cyber agency, said in a joint advisory that attackers are targeting "unpatched or internet-accessible" refrigeration controllers. They may use authentication bypasses, code injection or weak configurations, and can hide the true temperature from operators. So the defender sees little: no ransom note, no locked screens, just warm stock. ICA said the affected stores operate outside its central network.

The Secure by Design lesson

Refrigeration is operational technology, the computers that run machinery. The design decision that failed was letting remote management face the open internet. Sabcobel's director said the simplest fix is managing units over a secure connection, that most clients had moved to that since France, and that a software update alone is not enough because some units need physical modifications. That is the real cost: hardware, engineers and downtime, not a patch.

The NCSC, the National Cyber Security Centre, part of GCHQ, said on 3 November that organisations should stop connecting technology to the internet unnecessarily. The CISA advisory adds the other half: change default passwords, isolate these systems from business networks, and enforce safe temperature limits so a controller cannot be told to cook the stock whatever command arrives.

Questions for Monday

Which of our devices has a web login, and can it be found from outside?
Who at the supplier can reach it, and how?
Is there a hard limit that holds even if the software is wrong?
Who gets the 4am alert? Ahold Delhaize's stores were warned by text at about that hour.

Also this week

The NCSC's annual warning is really about thrift. Its State of the Cyber Nation report, published on 3 November, says UK critical national infrastructure should be braced for a ransomware attack involving AI-powered malware by 2028, and that hostile use of AI is "highly likely" to increase the scale and efficiency of attacks within two years. In his prepared remarks, chief executive Richard Horne said this is "not because AI has invented new ways to attack us", but because long-tolerated vulnerabilities "can now be discovered and exploited at a scale that was once unimaginable". He added: "For decades, we have collectively got away with doing tech on the cheap." He also urged leaders to treat Cyber Essentials as the starting point, not the end goal. The government has announced £60 million for a national Cyber Shield and £70 million for a new vulnerability centre. Cheap tech is a design choice, and the bill is arriving.

Microsoft's Outlook zero-day arrives with a record patch load. The Record reports that November's Patch Tuesday fixed 1,093 bugs, while BleepingComputer counts 1,235; the tallies differ, and both are far above a normal month. The Record adds that Microsoft has now disclosed more than 5,160 this year, far beyond any previous year. One bug is exploited: CVE-2026-124194, an Outlook spoofing flaw scored 6.5. An attacker sends a crafted message file, and opening it can make Outlook connect to an attacker-controlled location without the usual external-content warning, exposing NTLM credential hashes, the scrambled form of a password Windows uses to sign in. CISA has added it to its KEV list of flaws known to be exploited. The Record says Microsoft credits the finder, Benoît Sevens, with using Anthropic's Claude to discover it. Patch Outlook this week, and ask why your machines can offer those hashes outside the building at all.

Sources

If you want help working out what in your estate can be reached from the internet, get in touch.