IoT Security for Small Business: What the French Supermarket Fridge Hack Says About the Devices Nobody Manages

On Monday 12 October, supermarket managers across France opened their stores and found the freezers blowing hot air. Overnight, someone had taken control of the refrigeration controllers and changed the settings. At around 150 Intermarché stores the fridges climbed as high as 50°C for six hours, and every affected product went in the bin. Nobody stole a password database or encrypted a server. They reached a box on the wall that most store staff would never have thought of as a computer. That is the uncomfortable lesson for IoT security for small business. The devices most likely to hurt you are often the ones nobody on your team thinks they own.

This article is about those devices. The alarm panel, the camera recorder, the air conditioning controller, the router the installer left behind. What happened in France, why small businesses carry the same risk with less margin to absorb it, and a practical way to find and fix it in an afternoon.

What happened in France

France's national cyber emergency team, CERT-FR, published an alert on 12 October 2026 about attacks on supermarket refrigeration management systems made by Danfoss. A day later it widened the alert to cover Copeland and Dixell xweb controllers as well. On Tuesday 13 October, Finance Minister Roland Lescure told Parliament that about 700 of France's roughly 10,000 supermarkets had been affected, calling it "a wake-up call for everyone" (as reported by AP and Reuters, 13 October 2026).

The money adds up fast. Les Mousquetaires, the group behind Intermarché, said damages across its roughly 180 affected stores would run to several million euros, and its chief executive put national losses in the tens of millions in a single day. In Haguenau, one Intermarché and one E.Leclerc reported a combined €270,000 in spoiled goods. And Intermarché confirmed to AFP that its insurance did not cover this kind of incident.

Officials have not published exactly how the attackers got in. What is on the record is telling enough. Danfoss said the affected units "were running outdated firmware," and that most were obsolete models whose support had already ended. CERT-FR's advice was to pull any controller sitting on a public internet address offline, allow access only through a VPN or protected network, update the firmware and change default passwords. It also warned that a factory reset alone leaves an unpatched, end-of-life device open to being taken over again.

And the exposure did not end once the story broke. Reuters, using the Shodan search engine, counted at least 4,500 Danfoss web interfaces still reachable online days later.

Why IoT security for small business is the real story here

It would be easy to read this as a big retail story. Large chains, specialist refrigeration gear, nothing to do with a six-person design studio or a building company with a site office.

But the pattern is not about fridges. It is about a device that does a physical job, was set up by a contractor, was left reachable from the internet so someone could check on it remotely, and then ran for years without anyone touching it. Supermarkets are full of these. So are small businesses.

A report from internet scanning firm Censys, published on 14 October 2026, puts some numbers on the wider problem. It found roughly 134,000 industrial control devices reachable from the internet in early 2026, about 4% more than in 2024. About 70% sat on mobile or consumer internet connections, where the registration records usually point to the telco rather than whoever runs the equipment, so researchers who spot an exposed device often have no way to warn its owner (Cybersecurity Dive, 15 October 2026).

That last figure matters for small business. A device sitting on a consumer connection or a 4G modem is exactly what you get when an installer needs remote access and the quickest route is a SIM card or a port opened on the office router. It works. Then it stays that way.

The internet-connected devices in your business that nobody calls IT

Most small business owners can list their laptops and phones. Ask about everything else with a network connection and the list gets fuzzy. Here are the usual suspects:

• The security alarm panel. Often monitored remotely, often with an app, often set up by the alarm company with a login you have never seen.
• The CCTV recorder. Cameras usually feed into a recorder box with a web interface so you can check footage from your phone. Many are years old and have never had a firmware update.
• Air conditioning and building controls. Common in offices, clinics and shops, especially where a facilities or HVAC contractor monitors the system.
• Door access and smart locks. Keypads, card readers and app-controlled locks all have accounts, and those accounts often outlive the staff who used them.
• The installer's router or 4G modem. The extra box an NBN, solar or alarm technician left behind. It may give your network a second route to the internet that nobody knows is there.
• Solar inverters and battery systems. These usually connect to the internet so the installer or manufacturer can monitor output.
• Printers, label printers and point of sale hardware. These sit on the same network as everything else and often run old software.
• Cold storage and food equipment. Any café, restaurant, pharmacy or florist with monitored fridges or freezers is closer to the French story than they might think.

None of these feels like IT. That is exactly why they are the ones nobody watches.

Why these devices stay invisible

There are three reasons this category of equipment slips through, even in businesses that are careful with their laptops and email.

A contractor installed it

The alarm company, the electrician, the air conditioning technician. They came in, set the device up, connected it so they could check on it later, and left. The login details went into their system, not yours. If you are lucky, there is a sticker on the box. If you are unlucky, the password is still whatever came from the factory.

This is the heart of the contractor remote access problem, and it is the same blind spot as your IT provider's remote tools. The person who can reach the device is not on your staff, and you have no record of how they reach it. If that contractor goes out of business, sells to someone else, or simply stops servicing your account, the access often stays exactly where it was.

It works, so nobody looks at it

A laptop nags you to update. A CCTV recorder does not. As long as the cameras record and the fridges stay cold, nobody opens the settings page. Years pass. The manufacturer stops releasing updates. The model gets discontinued, the same way Windows 10 did, only nobody sends you a reminder. Danfoss said much the same about the French controllers. The ones that were hit were mostly obsolete and out of support.

When a device does its job quietly, "it hasn't caused any problems" becomes the evidence that it is fine. Mostly it is evidence that nobody has checked.

It was built to be reached from outside

Remote monitoring is the point of a lot of this equipment. The alarm company wants to see when the panel goes offline. The solar installer wants to see output. That convenience means the device is reachable from somewhere other than your office. If it is reachable by the installer, it may be reachable by anyone who finds it, and search engines like Shodan exist precisely to find these things.

Default passwords and what the new Australian rules do and do not fix

Australia has moved on part of this. Under the Cyber Security Act, new security standards for smart devices took effect on 4 March 2026. They require three things of manufacturers:

• No universal default passwords. Each device needs a unique password, or must make the user set one.
• A public way to report security problems to the manufacturer.
• A published support period, so buyers know how long the device will get security updates.

That is real progress. The catch is in the scope. The rules cover connectable products meant for personal or household use, and they apply to products being supplied to buyers. They are aimed at new devices. Commercial plant like refrigeration controllers sits outside that scope, and nothing in the rules goes back and fixes the camera recorder an installer bolted to your wall in 2019.

So the rules help when you buy something new. The published support period is especially useful, because it tells you when a device will stop getting fixes. For everything already installed, the work is still yours.

A one-afternoon IoT security check for small business

You do not need specialist tools to make real progress here. You need a list, a few phone calls and some honest answers. Set aside an afternoon and work through these steps.

1. Walk the building

Go room by room and write down everything with a power cable and either a network cable, a Wi-Fi connection or a SIM card. Check the comms cupboard, the ceiling space if you can get to it, under the reception desk and behind the TV. Look for boxes you can't name. Photograph the labels, because the make and model will matter later.

2. Write down who installed each device

Next to each item, note the company that installed or services it, and a contact name if you have one. This turns a pile of mystery boxes into a list of conversations to have.

3. Ask each contractor three questions

Call or email each one and ask:

• How do you connect to this device remotely, if at all?
• Who on your side has the login, and can you give us our own admin access?
• Is this model still getting security updates, and when does that stop?

A good contractor will answer these quickly. If one can't, or won't, that tells you something too.

4. Change any default passwords

If a device still uses the password it shipped with, change it. Store the new one in your business password manager, not on a sticky note and not only in the contractor's records. Make sure at least two people in your business can get to it.

5. Take things off the open internet where you can

CERT-FR's advice to French supermarkets applies here too. If a device does not need to be reachable from the internet, it shouldn't be. Where remote access is genuinely needed, ask your contractor to use a VPN or their vendor's secure remote service, rather than an open port on your router. If you don't know whether a device is exposed, ask whoever looks after your internet connection to check the router for open ports and port forwarding rules.

6. Flag anything out of support

If a manufacturer has stopped releasing updates for a device, put it on a replacement list with a rough budget and date. Out-of-support equipment is exactly what the French attackers found. It doesn't need replacing tomorrow, but it does need a plan.

7. Check your insurance

Intermarché's concern about cover is worth taking seriously. Ask your insurer or broker whether your policy covers losses caused by a compromised device, including spoiled stock, damaged equipment or a period where you can't trade. Get the answer in writing.

8. Put a date in the diary

Set a recurring reminder to repeat the walk-through every six months, and whenever you add new equipment or change contractors. The list only helps if it stays current.

Where Vera fits

Most of the work above is a list problem. You need one place that records what each device is, how old it is, and when it stops being covered. For most small businesses that list currently lives in a contractor's system, a drawer of invoices, or nobody's head.

That is the gap Vera was built for. Vera is an IT visibility dashboard for businesses with 1 to 20 staff, and its asset register isn't limited to laptops. You can add the alarm panel, the CCTV recorder, the inverter and the air conditioning controller alongside everything else, with the make and model, serial number, purchase date and warranty expiry for each. The logins go in your password manager, where they belong. The built-in task board turns step 6 and step 8 into tasks with due dates and notes, so the replacement plan and the six-monthly walk-through actually happen. Vera won't scan your network for you, and it doesn't replace your contractors. What it does is make sure the answers you collect this afternoon don't disappear into an email thread.

The French fridge hack is a reminder that good IoT security for small business starts with something unglamorous. Know what is plugged in, know who can reach it, and know when it stops getting fixed. If you'd like a single place to keep that list, you can see how Vera works at verait.io.