French supermarket refrigeration attacks expose third-party OT risk

At a glance

What this is: This is a report on cyberattacks that disrupted supermarket refrigeration in France, showing how connected supplier equipment can create physical business impact.

Why it matters: It matters because third-party and OT dependencies can fail outside an organisation's own perimeter, so IAM, supplier access, and operational resilience teams need a shared view of who controls exposed systems.

By the numbers:

• The report put the estimated scale at between 250 and 300 supermarket locations.

Context

This article is about third-party cyber risk in operational technology, where a supplier-managed connected system can become the point of failure for the customer. The issue is not only exposure inside the buyer's environment, but how remotely managed equipment, internet-facing interfaces, and outdated firmware expand the attack surface beyond what internal controls can directly govern.

For identity and access teams, the relevant question is who can authenticate to supplier-managed devices, how management interfaces are protected, and whether access is still needed at all. For operational leaders, the lesson is that supplier assessments that stop at questionnaire scores miss the real governance problem: business services can depend on equipment that sits outside the customer's day-to-day control.

Key questions

Q: What breaks when OT devices are exposed to the internet?

A: Internet exposure turns HMIs and PLCs into reachable control points rather than protected field assets. Once attackers can authenticate or exploit them, they can alter process settings, change credentials, and disrupt monitoring. The practical failure is not only compromise of a device, but loss of trust in the control plane that keeps physical operations stable.

Q: Why do outdated firmware and legacy controllers increase third-party cyber risk?

A: Outdated firmware keeps known weaknesses alive after the vendor has stopped normal update support, so the buyer inherits a permanent exposure window. Legacy controllers also tend to lack modern authentication, logging, and segmentation options. That combination turns a supplier maintenance issue into a business resilience problem, especially when the device controls a physical process.

Q: What signs suggest a supplier dependency can turn into an operational outage?

A: Watch for internet-reachable management interfaces, remote access that bypasses normal identity controls, unsupported firmware, and a lack of clear ownership for device updates. If the supplier can change physical processes but the customer cannot independently verify access, scope, or patch status, the dependency is already outside safe governance boundaries.

Q: How should organisations govern third-party access to connected equipment?

A: Treat it as privileged access to a production process, not as routine vendor support. Require named accounts, strong authentication, least privilege, logging, and explicit approval for each remote administration path. If the equipment influences safety, inventory, or trading continuity, the access model should be as controlled as any other high-risk privileged session.

Technical breakdown

Connected OT controllers create an exposed management plane

Refrigeration controllers are increasingly network-connected so suppliers can monitor, adjust, and maintain them remotely. That convenience creates a management plane that can sit apart from the store's core IT controls, especially when devices are deployed with legacy firmware or internet-reachable interfaces. Once those interfaces are exposed, attackers do not need to compromise the supermarket's business systems to affect operations. They can interact with the equipment that drives physical processes directly, which makes device hardening, exposure reduction, and remote administration governance central to risk management.

Practical implication: inventory every externally reachable OT management interface and remove or isolate the ones that do not need internet exposure.

Outdated firmware turns supplier support into a governance gap

Firmware is the embedded software that controls device behaviour, and when it is outdated it can leave known weaknesses in place long after normal IT patching cycles would have closed them. In this incident, the reported use of legacy controllers that no longer receive updates means the organisation may inherit a permanent support and security gap from the supplier ecosystem. The problem is not only vulnerability management. It is the absence of a clear lifecycle for replacement, patch ownership, and compensating controls when the vendor has ended normal update support.

Practical implication: tie OT procurement and renewal decisions to firmware support status, update cadence, and end-of-life replacement plans.

Third-party risk must include physical consequence paths

Traditional third-party risk management often focuses on data access, contractual controls, and security questionnaires. That is too narrow for connected industrial and retail systems. A supplier compromise can now trigger defrost cycles, spoil inventory, interrupt trading, or create safety issues even when customer IT remains untouched. The security model must therefore include service dependency mapping, operational blast radius, and the specific process each supplier enables. In this case, the risk was not abstract loss of confidentiality. It was loss of temperature control, product integrity, and store continuity.

Practical implication: map each critical supplier to the physical process it supports and test failure scenarios against that process, not just against IT systems.

Threat narrative

Attacker objective: The apparent objective was to disrupt supermarket operations by degrading refrigeration control and causing physical and financial damage.

1. Entry appears to have been through internet-exposed management interfaces on refrigeration controllers, according to France's cybersecurity agency.
2. Credentialed or authenticated access to the device management plane was then used to manipulate controller behaviour and trigger defrost cycles.
3. The operational effect was loss of cooling control, with temperatures rising high enough to spoil stock, disrupt stores, and in some reports contribute to fires.

Breaches seen in the wild

• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
• Vercel Context.ai OAuth Supply Chain Breach: Shadow AI app Context.ai OAuth integration exposes Vercel customer data via unmanaged third-party token.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Third-party cyber risk is now an operational resilience issue, not just a supplier assurance exercise. When connected equipment can alter temperature, halt trading, or damage stock, the governance question is whether a business can survive supplier technology failure. The supermarket case shows that questionnaires and scorecards are not enough when the dependency sits inside a physical process. Practitioners should treat supplier risk as a continuity control problem as much as a security control problem.

Exposed device management interfaces create a hidden access layer that many programmes do not model well. The management plane for OT and IoT often sits outside the identity controls used for employees and core applications, yet it can be the most direct route to operational disruption. That makes access governance, remote administration boundaries, and credential stewardship central to resilience. Where management access exists, it should be explicitly inventoried and constrained, not assumed to be low risk because it is not customer-facing.

Outdated firmware is a lifecycle governance failure, not a patching footnote. Once a supplier-supported device moves beyond active update support, the customer inherits risk that internal teams may not be able to remediate quickly. The important concept here is supplier firmware exposure debt: the accumulated risk created when critical connected equipment remains in service after vendor support, while business dependence continues. Practitioners should use that framing to drive replacement prioritisation.

Identity controls matter here because the attack surface includes who can administer third-party equipment and how that access is authorised. Remote access, shared maintenance accounts, and exposed interfaces can all weaken accountability when a supplier platform becomes the control point for physical operations. This is where IAM, PAM, and third-party access governance intersect with OT risk. Organisations should verify that privileged access to managed equipment is tightly scoped, time-bound, and attributable.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Third-Party, B2B and Contractor Access Guide

What this signals

The supermarket case shows why third-party risk programmes need a process-level view of dependency, not just a vendor-level risk score. If a supplier can affect refrigeration, production, or service continuity, the control objective shifts from checking the supplier to proving the business can absorb supplier failure.

Supplier firmware exposure debt: organisations accumulate hidden risk when connected devices stay in service after vendor support ends. The practical response is to tie procurement, lifecycle management, and replacement funding to support status instead of waiting for a vulnerability to force the decision.

Where third-party access reaches operational equipment, identity controls become a resilience control. Privileged access, named accountability, and narrow remote administration paths matter because the issue is not only who can log in, but whether that access can alter a physical outcome.

For practitioners

• Map critical supplier dependencies to physical business processes Document which suppliers, devices, and remote services keep each store, site, or production line operating, then rate them by operational blast radius rather than by security questionnaire score alone.
• Remove unnecessary internet exposure from OT management interfaces Identify refrigeration, building management, and other controller interfaces that can be reached externally, then restrict access to private networks or tightly controlled gateways.
• Track firmware support status as a procurement control Require evidence of active firmware support, update cadence, and end-of-life timelines before approving or renewing connected equipment used in critical operations.
• Review privileged access to third-party devices Check whether vendors use shared accounts, persistent remote access, or weak authentication to manage operational equipment, and replace those patterns with attributable, time-scoped access.

Key takeaways

• This incident shows how supplier-managed technology can disrupt physical operations even when internal business systems are not breached.
• The reported scale reached 250 to 300 supermarket locations, underscoring that third-party exposure can propagate quickly across an entire retail estate.
• The strongest control response is to map supplier access to business processes, remove unnecessary internet exposure, and treat unsupported firmware as a lifecycle risk.

Key terms

• Third-Party Cyber Risk: Security exposure introduced by an external vendor, supplier, or service provider that has access to systems, data, or infrastructure. It is not limited to contract risk. In practice, it is the combination of access, trust, and dependency that can be abused if identity and lifecycle controls are weak.
• Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
• Firmware: Firmware is the embedded software that runs a device at a low level and controls how it behaves. In IoT environments, outdated firmware is a major risk because vulnerabilities can persist for long periods, giving attackers an easy path to compromise devices that are rarely patched like standard endpoints.
• Management Interface: A management interface is the administrative access point used to configure, monitor, or control a system. These interfaces are sensitive because they often expose high-privilege functions. If they are reachable from the internet, a vulnerability can become much easier to exploit and much harder to contain.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security practitioners connect identity control to the wider operational risks that supplier dependencies create.