Compromise one supplier and you inherit its entire customer list. That arithmetic explains why the supply chain is becoming the attacker's favourite lever, and why boards should measure their exposure by who they depend on as well as by what they own.
The night the freezers became ovens
On the night of Sunday 11 October, refrigeration controllers in hundreds of French supermarkets were told to start a defrost cycle, and nobody told them to stop. By morning, cabinets that should have been holding frozen food were running at around 50°C, some units had melted or caught fire, and staff were filling skips with spoiled meat, dairy and ready meals. France's finance minister told Parliament that about 700 of the country's 10,000 supermarkets were affected, and the chief executive of Intermarché put the losses at tens of millions of euros in a single day.
Three weeks later, it happened again, this time across the continent. In the early hours of Monday 2 November, fridges and freezers were driven to the same temperatures in stores belonging to Ahold Delhaize and Colruyt in Belgium and Luxembourg, and ICA and Coop in Sweden, with further reports from Ireland, the Netherlands and Estonia. The UK did not escape. The NCSC's chief executive, Richard Horne, said his team was aware of a couple of instances of the vulnerable technology being exploited here, and the British Association of Independent Meat Suppliers described some of its members' stock as collateral damage.
Here is the detail that should keep a board awake. The retailers' corporate networks were never the point of entry. Nobody phished the finance team, and nobody encrypted the head office file servers. The attackers went after refrigeration controllers built by a handful of manufacturers, commonly installed and run by outsourced maintenance firms, and reached hundreds of businesses through one shared dependency.
The attacker's arithmetic
Archimedes reputedly said that with a long enough lever and somewhere to stand, he could move the world. Attackers have worked out where to stand. A supplier serving a thousand customers is a fulcrum: the effort to compromise it is spent once, and the impact is collected a thousand times.
Think of a block of flats. A burglar can spend all night picking a hundred front-door locks, or copy the master key the caretaker keeps on a hook by the door. The supply chain is that hook. The managed service provider, the software update server, the remote maintenance portal and the cloud platform all hold a key to every customer they serve, and every customer has agreed to let them in.
Three properties turn that access into a multiplier.
Trust. The supplier's activity is expected, so a malicious update or a remote session rarely trips an alarm.
Concentration. Whole sectors standardise on a handful of platforms, so one weakness is copied across thousands of sites.
Coupling. Operations run just in time, so a stoppage upstream reaches the shop floor, the hospital ward or the departure gate within hours.
There is a fourth property that matters most to a board. The supplier sets its security budget against its own risk appetite, while the losses land on customers who never had a vote. Your exposure is partly decided in someone else's budget meeting.
Thirteen years of the multiplier
The freezer attacks are new in their physical effect, not in their shape. The same geometry, one supplier and many victims, runs through most of the significant incidents of the last decade.
| Date | Supplier hit | Downstream reach | What it showed |
|---|---|---|---|
| Oct–Nov 2026 | Refrigeration controllers from Danfoss and Copeland | About 700 French stores on 11 October; a second wave on 2 November across Belgium, Luxembourg, Sweden and beyond, including UK sites | Third-party operational technology is part of your estate |
| Sep-25 | Collins Aerospace MUSE, shared check-in and boarding platform | Heathrow, Brussels and Berlin pushed back to manual check-in | Competitors who share a platform share a failure |
| May-25 | Peter Green Chilled, chilled food distributor | Serves most major UK supermarkets; producers' meat stranded in its warehouses | A mid-sized logistics firm can empty a national brand's shelf |
| Nov-24 | Blue Yonder, supply chain software | Starbucks paid staff by hand; Morrisons and Sainsbury's warehouse systems disrupted | Rehearsed contingency plans decided who coped |
| Jun-24 | Synnovis, NHS pathology provider | More than 6,000 operations and appointments postponed at two London trusts within a month | The multiplier reaches patients |
| Jun-24 | CDK Global, dealer management software | Around 15,000 North American car dealerships | One platform can halt an industry's sales |
| Feb-24 | Change Healthcare, US claims clearing house | 192.7 million people's data; claims processing disrupted for months | Invisible plumbing becomes very visible when it bursts |
| May-23 | MOVEit Transfer, file transfer software | 2,773 organisations and roughly 96 million individuals | One flaw, thousands of separate breach notifications |
| Jul-21 | Kaseya VSA, IT management tool used by MSPs | Fewer than 60 direct customers, up to 1,500 downstream businesses; Coop Sweden, two steps removed, closed most of its 800 stores | Your supplier's supplier counts |
| Dec-20 | SolarWinds Orion, network monitoring | Fewer than 18,000 customers installed the tainted update | The trusted update channel became the attack channel |
| Jun-17 | M.E.Doc, Ukrainian accounting software (NotPetya) | Maersk, Merck, FedEx/TNT and many others; more than $10bn of damage | Collateral damage travels at network speed |
| Nov-13 | Fazio Mechanical, refrigeration and HVAC contractor | Target: 40 million payment cards and 70 million customer records | The fridge contractor was the side door |
Read down the right-hand column and a trend appears. The early cases cost data: card numbers and personal records. The middle cases cost operations: tills that would not open, dealerships that could not sell, payroll worked out with a calculator. The recent cases cost physical things: postponed surgery, melted freezer cabinets and food in skips. The multiplier has moved from the database to the shop floor.
The geometry also runs upstream. When Jaguar Land Rover stopped its lines for five weeks in autumn 2025, the Cyber Monitoring Centre put the cost to the UK economy at £1.9bn, with more than 5,000 organisations affected, and the government underwrote a £1.5bn loan guarantee so the company could keep paying its suppliers. Stop the hub and the spokes go hungry.
And look at the bookends. In 2013, attackers reached Target using credentials stolen from its refrigeration contractor. Thirteen years later, they reached hundreds of supermarkets through the refrigeration controllers themselves.
What the cold chain teaches
The refrigeration controller is the most trusted member of staff in a supermarket. It works nights, nobody checks on it, and it holds the keys to the most perishable stock in the building. The details of how that trust was abused will look familiar in every sector.
Nobody owned the risk. The controllers sat in the retailers' stores, were built by a manufacturer and were commonly run by outsourced maintenance firms. French supermarkets typically outsource refrigeration and have little say over its security, and Groupement Mousquetaires said its systems were under the supplier's management, adding that filing a police complaint was the supplier's job. Facilities owned the fridge, IT owned the network and a contract owned the access. The attacker found the gap between the three.
The window was long and public. Danfoss published an advisory in March 2025 and shipped a fix that August, while two of the affected models had reached end of life in 2016 and 2021. Thousands of the devices were reachable directly from the internet, with a username of admin and a password that was simply the date. A supply chain patches at the speed of its slowest contractor.
The monitoring watched for the wrong thing. The alarms were built to catch a failing compressor. A controller faithfully obeying a malicious instruction looks perfectly healthy, so the French attack set off no alarms and the first detection system was the member of staff who opened up in the morning.
The damage could not be restored. Nobody recovers a pallet of chicken from backup. Recovery meant food safety decisions, insurance claims and replacement stock and, before anything was switched back on, confidence that the controller itself was clean. As I argued in The Reconnection Problem, bringing a compromised system back online can be more dangerous than the original outage.
The playbook could be replayed. Three weeks after France, a similar attack swept across Europe. A known technique stays profitable until the last vulnerable device is fixed, so the multiplier works across time as well as across customers.
