During the night of 11 to 12 October 2026, attackers seized remote control of the refrigeration systems serving hundreds of French stores. Intermarché, Netto, Super U, E.Leclerc, Carrefour and Monoprix were among the chains affected. Display cabinets were pushed to 50 °C. Within 48 hours, Groupement Mousquetaires had restored its 300 stores. France's national cybersecurity agency (ANSSI) was called in and the Paris prosecutors opened an investigation. Behind the media shock, the incident points precisely to a gap that many NIS2 programmes still share.
What happened technically
ANSSI confirmed on 13 October 2026 the compromise of Copeland XWEB and Dixell XWEB controllers, two refrigeration management systems manufactured by Danfoss. The models involved, AK-SM800 and AK-SC355, have reached official end of life: Danfoss has not published security patches for them in several years.
These devices were exposed directly on the internet, with no VPN or network segmentation. An article by La Clé Publique dated 15 October 2026 reveals that at least one device had been compromised as early as August 2026, meaning the attacker had been present for at least two months before the destructive phase. The final attack did not involve data exfiltration: it modified setpoint parameters to trigger a temperature rise.
This profile is characteristic. An attacker seeking disruption chooses visible action. An attacker seeking time stays quiet for weeks. Two months undetected on production equipment is a level of persistence associated with well-organised threat actors.
Why large retailers fall under NIS2
The NIS2 Directive, Annex II, covers food production, processing and distribution companies with more than 250 employees or more than EUR 50 million in annual turnover. Major French retail groups meet these thresholds: they are important entities under the Directive.
As important entities, they are required to implement risk management measures covering, among other areas, the security of networks and information systems, asset management and business continuity. This obligation extends to all systems that support their essential services. Network-controlled refrigeration management systems are among them.
The French transposition, once adopted, will confirm this reading. In the meantime, the EU framework applies directly to entities whose competent authorities have begun the designation process. Ignoring OT assets in a NIS2 programme does not reduce the obligation: it creates a blind spot that is documentable during an inspection.
OT: absent from most NIS2 asset inventories
NIS2 programmes have been built, for the most part, around IT systems: servers, workstations, business applications, email. Operational technology (OT) assets have been treated separately, or ignored entirely.
This separation is an organisational relic. XWEB controllers connect to the same IP network as IT systems. They use standard protocols. They are administered remotely via web interfaces. They are network devices, whether or not they are labelled "technical equipment" in the organisational chart.
The problem goes beyond refrigeration. Industrial controllers, connected building management systems, networked physical access control systems, weighing and measurement equipment, standalone payment terminals: all can be internet-facing. None is necessarily in your NIS2 inventory. Our article on shadow IT and unknown assets in the NIS2 scope documents this issue for conventional IT assets. The October incident shows that the same risk, with the same regulatory consequences, applies to OT assets.
Two months undetected: a regulatory failure
NIS2 sets two notification deadlines: 24 hours for the initial alert, 72 hours for the full report. These deadlines assume the incident has been detected. An attacker present for two months on your infrastructure did not trigger any notification because they had not been detected.
OT equipment does not, by default, produce logs that can be ingested by a SIEM. It is not monitored by SOC teams. It does not appear in detection dashboards. Without centralised logging of these devices and correlation with your detection tooling, the attacker's dwell time could have been far longer than two months.
NIS2 compliance is not limited to documented policies and technical measures on servers. It requires covering the entire scope, OT included, with a detection capability consistent with the imposed notification deadlines.
What ANSSI recommends
ANSSI published recommendations immediately after confirming the incident. Two points are worth retaining beyond the Danfoss case.
First: remove direct internet exposure of OT devices. Remote maintenance is permitted, but only over a protected network or a VPN connection with strong authentication. This recommendation has appeared in ANSSI's IT Hygiene Guide since 2017. It is not new. It is widely disregarded.
Second: for end-of-life devices with no available patches, isolation or replacement are the only viable options. Running an unmaintained network device in a NIS2 scope constitutes a clear non-compliance, documentable during a maturity audit.
Three actions to take immediately
Include your OT assets in your NIS2 inventory. Ask your technical teams for a list of all network-connected devices that are not conventional workstations or servers. Controllers, PLCs, human-machine interfaces, measurement equipment: each must appear in your asset register with its software version, maintenance status and network access method.
Check the internet exposure of these devices. An external attack surface scan on your address ranges will give you, within a few hours, the list of assets directly reachable from the internet. If OT controllers appear in that result, take them offline or isolate them behind a VPN before any other action.
Identify end-of-life OT devices with no available patches. An end-of-life asset on a NIS2 network, with no documented replacement plan, is a risk to formalise in your register. It must be subject to an explicit compensating measure in your risk assessment.
If this review has not yet been carried out in your organisation, our NIS2 diagnostic service includes an analysis of the asset scope subject to security obligations, OT included.