Why 'Our Contractor Manages That' Is Not a Security Boundary for OT

When Intermarché explained why its cold aisles were at 50°C on the morning of 12 October 2026, it pointed to "a service provider that manages refrigeration systems in stores." That sentence is accurate, and it is also the problem. In most multi-site businesses the refrigeration, the HVAC, the lighting and the access control are owned by the company but operated remotely by a contractor, through connections the company's security team has never reviewed. The French attack hit hundreds of stores across at least six chains in one night, which is only possible when the remote-access arrangement is shared and the security of it is nobody's job. This article is about making it somebody's job.

The arrangement that makes mass compromise cheap

A refrigeration contractor serving several hundred supermarkets has a small technical staff and a large installed base. Economics push the arrangement toward uniformity: the same controller model at every site, the same installation template, the same remote-access method, and very often the same password. The contractor needs to get into any site from anywhere at two in the morning when an alarm fires, so the controller gets a public address or a port-forward, sometimes through a contractor-owned cellular modem the retailer's IT team never sees.

From the attacker's side this is ideal. Compromise one credential, or find one hidden authentication path, and the whole fleet opens. CERT-FR's alert after the French attack listed controllers from Danfoss, Copeland and Dixell, three different vendors, which suggests the campaign exploited the arrangement rather than one product. Exposure numbers bear this out: Predicta Lab counted 2,752 Danfoss systems reachable on the internet the morning after, 1,590 of them in France. None of those devices was exposed by the retailer's security team. All of them were exposed under a contract the retailer signed.

Why end-of-life hardware is a contractual problem

Danfoss said most of the units hit were the AK-SM800, end of life since 2021, and the AK-SC355, phased out in 2016. Both have been unsupported for years. The vendor said it had long advised customers to migrate. Yet they were still running the cold chain at hundreds of stores because a controller that keeps the cases cold is, from a facilities budget's point of view, a working controller.

This is where IT's patch-management discipline and facilities' lifecycle discipline diverge. IT retires a server when support ends because the risk is understood. Facilities retires a controller when it fails because the risk was never priced. Closing the gap requires three things: an inventory that records support status for every OT device, a funded replacement schedule triggered by vendor end-of-life announcements rather than by hardware failure, and an interim rule that any unsupported device loses all remote reachability until it is replaced. How to Inventory the OT Controllers Your Facilities Contractors Put Online covers building the inventory; the budget line is a management decision that this incident should make easier to argue.

For supported hardware, the same ownership question applies to firmware. Danfoss published fixes for the AK-SM 8xxA series in March and August 2025. Fourteen months later, some current-generation units in France were still on outdated firmware. The contractor did not apply the update because the contract did not require it, and the retailer did not ask because it did not know the device existed.

What the contract has to say

Third-party remote access to OT is a managed-service relationship and the contract should treat it as one. The clauses that matter:

• Named access only. The contractor connects through a remote-access service the client controls, with individual accounts per technician, multi-factor authentication, and session logging. Shared passwords on the device itself are prohibited, and the client may verify.
• No independent connectivity. The contractor may not install modems, port-forwards or any other network path without written approval from the client's security team. Existing ones are declared within thirty days.
• Patch and lifecycle obligations. The contractor applies vendor security updates within a defined window and gives notice when a device it maintains reaches end of support. The client funds replacement; the contractor cannot keep an unsupported device connected.
• Baseline and change control. Defrost schedules, set points and alarm thresholds are documented, and changes outside the baseline are logged and reported. This is also the food-safety auditor's requirement, so it rarely meets resistance.
• Incident cooperation. The contractor preserves logs and provides access records on request, and notifies the client of any compromise of its own systems that could affect client sites.

None of this is exotic. It is what any organisation already requires of its managed IT provider. The only novelty is applying it to the people who manage the compressors.

Monitoring the join

A contract sets expectations; it does not detect a breach at two in the morning. Two controls close that gap and both are cheap relative to a bin full of frozen stock.

The first is independent temperature monitoring. The French attackers used the controller's own functions, so the controller's own readings and alarms were under their control. Claroty's Team82 had warned in August 2026 that a compromised Danfoss unit could falsify temperature data. A separate probe in each cold room, reporting to a system the controller cannot reach, turns a six-hour silent defrost into a thirty-minute alert. For the technical reasoning see How a Refrigeration Controller's Web Interface Becomes a Physical-Damage Attack Surface.

The second is monitoring the access path itself. If every contractor session goes through a jump host you own, you can see which technician reached which site when, alert on sessions outside maintenance windows, and cut access centrally when a contractor reports a compromise. If the path is a public IP on a cellular modem, you see nothing until the fridge is warm.

Who signs for it

The practical blocker in most organisations is that facilities owns the contractor relationship, IT owns the network, and security owns neither the budget nor the contract. The French incident is a useful forcing function because the loss landed on the retailer, not the contractor, and it landed in a single night. Put a named executive on the hook for third-party OT access, give security a veto over new connectivity in facilities contracts, and fund the end-of-life replacement line. The attackers who defrosted France did not need a zero-day. They needed an arrangement in which the people who could have stopped them did not know it was theirs to stop.