Hacked Supermarket Freezers and the Real Lifespan of OT Equipment

It has happened again

Three weeks ago I wrote about the supermarket refrigeration cyberattack in France, where hackers turned freezers into ovens, and thought, well, that will focus a few minds. Overnight on 1 to 2 November it happened again, this time across Belgium, Sweden and Ireland. Delhaize says “several dozen” Belgian stores were hit, with around 40 reported. Roughly 15 Carrefour stores in Belgium went the same way, along with Intermarché, Spar and Shop & Go sites. In Sweden, ICA confirmed a “small number” of stores and one ICA Nära manager on Öland said his freezers had been set to 55°C. Coop reported six Swedish stores with problems. In Ireland, Musgrave says at least 13 SuperValu stores were affected.

Nobody has said who is behind it, and nobody has yet confirmed that this second wave used the same route in as the first. But the pattern is hard to ignore, and the story underneath it is one I have been banging on about for years: we are running modern businesses on connected kit that stopped getting security fixes a long time ago.

A quick recap of France

On the night of 11 October 2026, attackers took remote control of refrigeration in hundreds of French supermarkets and pushed the cases into defrost, with temperatures reaching as much as 50°C. Stock was binned, some equipment began to catch fire, and Les Mousquetaires’ CEO is talking about losses in the tens of millions of euros. I covered the chains, the costs and the blame game in detail in the original piece, so I won’t repeat it all here.

CERT-FR issued an alert the following day naming two older Danfoss refrigeration controller families, the AK-SM and AK-SC series. Danfoss said most of the units hit were older products that no longer receive updates. The two models it called out tell the whole story:

• AK-SM 800 – end of life since May 2021, no updates.
• AK-SC 355 – phased out in 2016, no updates.

Some units of the current model, the AK-SM 800A, were also hit, and some of those were running out-of-date firmware. After the French attack, Reuters used Shodan to count more than 4,500 Danfoss management interfaces still reachable from the open internet. Read that again. Four and a half thousand supermarket cold rooms, sat there with the front door facing the street.

OT is not IT, and that’s the whole problem

The box that got hacked is what we call operational technology, or OT. IT is the stuff in the office: laptops, servers, email. OT is the computer that runs something physical. In a supermarket, one controller looks after every fridge and freezer in the shop, setting the temperatures, running the defrost cycles and raising the alarms. It is connected to the internet for a perfectly sensible reason: so the refrigeration maintenance firm can see it and adjust it from somewhere else, rather than sending an engineer out at 3am.

That convenience is exactly what bit them. The difference between the two worlds isn’t really the technology any more. Inside, a lot of OT is just a small Linux box with a web interface. The difference is how it is bought, owned and looked after: IT gets replaced every three to five years and patched every month, while OT is expected to run for 10 to 20 years and is patched rarely, if ever. I’ve gone through the full comparison in OT vs IT: what’s the difference and why it matters.

The bit I’d underline here is ownership. In plenty of stores, nobody in the business thinks of the refrigeration controller as a computer. The IT team doesn’t know it exists, facilities think the contractor handles it, and the contractor is paid to keep things cold, not to run a vulnerability management programme. So it gets installed once, configured once, and left alone for a decade. Nobody is negligent on paper. Everybody is negligent in practice.

If the fridge lasts ten years, why doesn’t the software?

Here’s what really gets me. Commercial refrigeration is built to last. The usual rule of thumb is 10 to 15 years for the kit, and 20 is not unusual with good maintenance. Nobody rips out a run of chilled cabinets because a newer model has come out. So the controller bolted to that system is, by design, going to be in service for 10 to 20 years.

Now look at the AK-SC 355. Phased out in 2016. If a store fitted one in, say, 2012, the cabinets it controls could happily be running until the late 2020s or beyond. The controller’s software support was over in four years. The rest of its working life has been spent online, unpatched, waiting.

My view is simple. The security support life of the embedded controller should be at least as long as the expected working life of the thing it controls. Not the sales life of that model. Not the length of the manufacturer’s product roadmap. The life of the asset on the shop floor. If you sell me something that is going to run a freezer for 15 years, you are selling me 15 years of responsibility, whether your marketing department likes it or not.

Europe is, slowly, heading the same way. The EU Cyber Resilience Act requires manufacturers to declare a support period for connected products of at least five years, and the Commission’s guidance says that period should line up with how long the product is reasonably expected to be in use. Five years is a floor, not a target. A refrigeration controller with a 15 year working life shouldn’t be getting five. But the CRA’s main obligations don’t fully apply until 11 December 2027, and it won’t reach back and fix the thousands of old controllers already screwed to supermarket walls. In the UK, the PSTI regime is about consumer connectable products, so it does nothing for a commercial cold room either.

The support clock starts before you buy

This isn’t just a refrigeration problem, and it isn’t just something that happens to other people’s kit. It catches people out every time they buy connected hardware, because most buyers think the support clock starts when they open the box. It doesn’t. It usually starts when the manufacturer stops making the thing.

Take cellular routers, which is the world I know best. Teltonika is actually one of the better vendors here, because it publishes its end of life policy: five years of firmware support from the end of production, with security and bug fixes for the first 24 months and then only critical security fixes for the remaining 36. Plenty of vendors don’t commit to anything in writing at all. But look at what that means in practice.

The best live example is the RUTX50. In August 2026 Teltonika put the entire RUTX series into end of life, because Qualcomm is discontinuing the CPU platform underneath it. Nobody did anything wrong. A chip supplier made a decision a couple of tiers down the supply chain, and the router that started Teltonika’s 5G story began its countdown. The dates are published: ordering closes on 3 February 2027, production stops on 3 August 2027, security and bug fixes run to 3 August 2029, and critical fixes only after that until 3 August 2032.

So say you buy a RUTX50 this month because it’s the model you know, the installers know it and the price is good. You get under three years of full security and bug fixes, and under six years of any fixes at all. A router in a comms cabinet will happily run for ten. Buy the current replacement, the RUTM50 or RUTC50, and its support clock hasn’t even started yet, because it starts when production stops, not when you buy. Similar money, same job on the wall, potentially years more supported life.

And those years matter. Last week Teltonika disclosed CVE-2026-82104, a critical flaw in RutOS rated 9.4 out of 10 that covers the RUTX range among many others. The fix is there because the RUTX is still inside its support window. Find the same class of bug in 2033 and an end-of-life RUTX would simply stay vulnerable, exactly like those Danfoss controllers.

My rule: before you buy anything that will sit on a network for years, check whether it has been announced end of life, find the vendor’s published support policy, and work out the end of support date. Then compare it with how long you actually expect the thing to be in service. If the second number is bigger than the first, you’ve just bought a future problem.

What if the manufacturer simply disappears?

End of life is at least an orderly death. You get a date, a replacement model and a few years of fixes. The worse case is the vendor going bust, being bought and shut down, or quietly walking away from a product line. Then the patches stop overnight, the firmware download page vanishes, and if the device depended on the vendor’s cloud for management or licensing, you might lose that too. No regulation fixes that. You can’t make a company that no longer exists ship a security update.

The IoT market has had plenty of consolidation and casualties over the past few years, and there will be more. So for anything with a long service life, I’d be asking these questions at purchase time, not after the press release:

• Is there a published EOL and security support policy? In writing, with numbers. No policy means no promise.
• How exposed is the vendor? Size, track record, how long they have been shipping this category. A cheap box from a startup with one product carries a different risk to an established manufacturer with a decade of history.
• Does it need the vendor’s cloud to work? Kit that can be configured and managed locally will outlive a dead cloud service. Kit that bricks without one won’t.
• Is the firmware built on something open? Plenty of routers run firmware based on OpenWrt, Teltonika’s RutOS among them. That doesn’t guarantee anyone will maintain your model after the vendor goes, but it gives you far more options than a closed proprietary stack.
• Can you design it out of the blast radius? If a device is never directly reachable from the internet and sits behind something you can patch, an unsupported device becomes a manageable risk rather than an open door.

The EU Cyber Resilience Act will make support periods a legal obligation for products placed on the EU market from late 2027, and that is genuinely welcome. But a support period is only as good as the company standing behind it. Choosing who you buy from is part of your security, not just part of your procurement.

So when is it time to upgrade?

For OT, “when it stops working” is the wrong answer, because these things don’t stop working. They keep doing their job right up to the point somebody else starts doing it for them. I’d use these triggers instead:

• The vendor has declared it end of life or end of support. That is the moment the clock starts, not the moment it stops. Every known flaw from then on stays open forever.
• It can’t run current firmware. If the hardware can’t take the version with modern authentication and enforced HTTPS, it is done, whatever it looks like.
• It is reachable from the public internet and you can’t fix that without breaking how the contractor supports it.
• Nobody can tell you who owns the patching. If the answer is a shrug, treat it as unsupported.
• The cost of failure has changed. One night’s lost stock across a few stores can dwarf the price of a controller swap. The French losses are being counted in tens of millions.

The bigger picture

Fridges are just the version of this story that made the news, because you can see the result in the freezer aisle. Swap “refrigeration controller” for building management, EV chargers, water pumps, car park barriers or the cellular router in the comms cabinet that nobody has logged into since 2017, and you have the same problem. Long-life kit, short-life software, and a remote access path someone set up for convenience and forgot about.

I don’t know where this goes next, and I’d be surprised if this is the last time I’m writing about it. But if you run sites with OT in them, now would be a good week to walk round with a clipboard, find every box that talks to the internet, and ask three questions: who made it, is it still supported, and who would notice if someone changed it. If you can’t answer all three, you have your upgrade list.

And if you’re doing the weekly shop in Belgium or Sweden this week, check the frozen stuff is actually frozen before it goes in the basket.