Industrial IoT cybersecurity consists of protecting connected equipment that controls a physical process. Attacks against French refrigeration controllers in October 2026 show that simple remote access can cause a temperature increase, damage equipment, and interrupt operations. For an SMB, the priority is clear: eliminate direct exposure to the Internet, control access, and monitor critical settings.
What happened in French supermarkets?
On October 11 and 12, 2026, remote compromises disrupted the refrigeration controllers of hundreds of French supermarkets. According to Associated Press, the affected chains included Intermarché, Netto, Coopérative U, Carrefour, E.Leclerc, and Monoprix. Modified settings caused food losses and property damage.
On October 13, 2026, CERT-FR identified several families of compromised equipment: Danfoss AK-SM and AK-SC, Copeland XWEB, and Dixell XWEB. The CERTFR-2026-ALE-012 alert indicated that the attack campaigns were probably still active. The second wave targeting Dixell installations mainly showed that the incident did not concern just one manufacturer.
The consequences extended beyond the IT system. Defrost cycles were prolonged and temperature setpoints were manipulated. In 2026, Le Monde reported that a cold room at an Intermarché had reached 50°C after a one-hour defrost cycle was changed to eight hours. Another store reported equipment temperatures of 80°C.
On October 13, 2026, the French Minister of the Economy estimated that approximately 700 of 10,000 supermarkets had been affected, according to Associated Press. This figure remains an estimate reported by a single source. The cyber unit of the Paris prosecutor’s office opened an investigation covering destroyed goods, damage, and potential fire risks.
Why does industrial IoT cybersecurity concern SMBs?
Industrial IoT cybersecurity concerns any SMB whose connected equipment affects refrigeration, heating, energy, access to facilities, or production. A compromise is not limited to data theft: it can alter a physical process, halt operations, and result in replacement or restoration expenses.
IoT stands for “Internet of Things”: devices capable of exchanging data over a network. OT, or “operational technology,” refers to systems that monitor or control machines and physical processes. A connected cold-room controller therefore falls under both IoT and OT.
The most common trap is not always a spectacular vulnerability. It is an administration interface left accessible from the Internet to facilitate maintenance by a service provider. Claroty stated in 2026 that it had identified 2,765 Danfoss AK-SM 800A controllers exposed on the Internet using the technical search engine Censys as part of its research.
This operational convenience shifts the risk to the operating company. Who verifies updates? Who closes an account belonging to a former technician? Who detects a setpoint changing from −22°C to an abnormal value? In the projects we conduct, we often see these responsibilities divided among IT, maintenance, and the supplier, without a clearly designated owner.
Dependence on service providers also needs to be addressed in contracts. Security requirements can extend to small businesses through their contracting customers, as explained in our analysis of the cascading effect of NIS2 on subcontractors.
Is a software patch enough to protect connected equipment?
A patch reduces known vulnerabilities, but it does not by itself protect industrial IoT equipment. Defense also relies on avoiding public exposure, using individual credentials, separating the network, and monitoring changes. The exact attack vector in the French attacks of October 2026 had not been confirmed as of October 13, 2026.
This nuance avoids a hasty attribution. Vulnerabilities did exist in certain Danfoss equipment, but no source available as of October 13, 2026, made it possible to assert that they had been used during this campaign. An exposed interface, a compromised password, or another weakness could also have played a role.
In 2023, Synacktiv documented vulnerabilities in the Danfoss AK-SM 800A prior to firmware version 3.3 that made it possible to extract a password hash and, by combining the vulnerabilities with authenticated access, execute commands remotely. Firmware is the equipment’s internal software.
In 2025, vulnerabilities CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 affected Danfoss AK-SM 8xxA controllers. According to Claroty in 2026, Danfoss firmware 4.3.1 notably addressed command-injection and configuration-control vulnerabilities. However, installing a patch in production requires a backup, testing, and the ability to roll back; our guide on patch management without production downtime details this discipline.
| Equipment or family | Documented finding | Action prioritaire |
|---|---|---|
| Danfoss AK-SM 800A | Vulnerabilities documented in 2023 before version 3.3 | Check the version and remove direct Internet access |
| Danfoss AK-SM 8xxA | Three CVEs published in 2025; patches included in version 4.3.1 | Evaluate updating to 4.3.1 or a later validated version |
| Danfoss AK-SM and AK-SC | Compromises reported by CERT-FR on October 13, 2026 | Check all settings and defrost cycles |
| Copeland XWEB and Dixell XWEB | Equipment added to the CERT-FR alert in 2026 | Close public exposure and restore access through a protected network |
Frankly, updating while keeping an administration console open to the public leaves an unnecessary loophole. Danfoss documentation from 2026 also recommends placing devices behind a firewall, with secure remote access. For marketed software, responsibilities are also evolving with the Cyber Resilience Act and its obligations in 2026.
What measures should be prioritized for an industrial IoT environment?
An industrial IoT cybersecurity plan begins with an inventory, then closes public interfaces before segmenting networks and correcting equipment. In 2026, CERT-FR also recommends checking every setting, replacing default passwords, and restoring administration access only through a protected network or a secure VPN.
A VPN, or virtual private network, creates an encrypted passage to the company’s network. It must not become permanent shared access. Each service provider receives a limited account, enabled during the intervention and associated with logs showing who connected and what actions were performed.
Here is the most effective action plan for quickly reducing risk:
- Inventory assets. Record the manufacturer, model, serial number, firmware version, network address, internal owner, and associated service provider.
- Close Internet exposure. Remove public administration interfaces and block ports that are not needed for business operations.
- Review access. Remove default passwords, create named accounts, and limit permissions to the intended task.
- Segment networks. Separate the IT office network from the OT operational network so that a compromised workstation cannot directly reach the controllers.
- Update methodically. Back up the configuration, verify compatibility, test the patch, and plan a rollback to the previous version.
- Monitor independently. Trigger an alarm in the event of an unusual change in temperature, defrost schedule, or network configuration.
The OT recommendations published by CISA between 2025 and 2026 emphasize inventorying equipment and firmware, prioritizing critical assets, separating IT and OT, and routing vendor access through a monitored bastion server or VPN. A bastion server, sometimes called a jump server, centralizes and logs administrative connections.
How can equipment be monitored without relying on the compromised system?
Monitoring an industrial IoT device should remain independent of its administration console. A network probe or separate physical alarm can signal unusual traffic, an inconsistent setpoint, or a configuration change. CISA’s industrial security recommendations published between 2022 and 2026 support this principle of separate control.
If an attacker controls the regulator and the screen displaying its status, the operator may receive misleading or delayed information. An independent temperature probe connected to a separate alert channel makes it possible to compare the actual temperature with the recorded setpoint. For a cold-storage room, this redundancy directly protects the products.
Thresholds must be adapted to the business context. An unusual nighttime connection, several parameters changed within a few seconds, or a significantly prolonged defrost cycle warrants an alert. Le Monde reported in 2026 that a service provider had observed two or three Dixell parameters being changed per second, suggesting an automated action without proving the intrusion mechanism.
From the agency’s perspective, the alert path should also be tested: an absent recipient, a full mailbox, a blocked notification, or an unmaintained phone number. A sensor that correctly detects the incident but alerts no one does not reduce the exposure time.
How can an IoT attack response plan be prepared?
An IoT response plan must specify who isolates the equipment, who verifies the physical process, and who authorizes the return to service. The priority is to protect people and facilities, preserve evidence, check all parameters, and restore a known configuration. Simply resetting the password is not enough.
For a refrigeration facility, the technical team must be able to switch to a safe local mode if the manufacturer allows it, record temperatures using an independent device, and photograph the settings before making any changes. Connection logs, exported configurations, and alarm timestamps will then help the service provider, insurer, or investigators.
The system should be brought back online only after public exposure has been eliminated, credentials have been renewed, and the settings—including defrost schedules—have been reviewed. CERT-FR specifically recommended these checks on October 13, 2026. Recovery should be gradual and closely monitored.
Industrial IoT cybersecurity is therefore not an isolated purchase, but an organizational effort involving management, IT, maintenance, and suppliers. Defining responsibilities, access rights, and procedures before an incident prevents many unpleasant surprises. This is often the stage at which an outside perspective saves time.
FAQ on the security of industrial IoT equipment
How can you tell if industrial equipment is exposed to the Internet?
A network audit and a review of firewall rules make it possible to identify publicly accessible interfaces. The inventory should also identify port forwarding, remote administration services, and access installed by service providers.
Is a VPN enough to secure remote maintenance?
A VPN protects the connection channel, but it must be supplemented by individual user accounts, limited permissions, logging, and restricted access duration. A shared or permanent VPN account remains a high risk.
Should a compromised PLC be disconnected immediately?
Disconnecting a compromised PLC depends on the physical risk and the process being controlled. The operator must first protect people and equipment, then isolate the network according to a procedure prepared with the maintenance provider to avoid a hazardous shutdown.
Who should manage updates for professional connected devices?
Responsibility for updates must be assigned in writing to the company, maintainer, or manufacturer, in accordance with the contract. An internal manager must nevertheless verify the installed versions, security advisories, and the actual completion of the operations.