How an Attack Reaches a Fridge Without Touching the Internet

Not every affected controller was internet-facing. The French incident covered about 700 stores, while exposure measurements describe a much smaller set of publicly reachable interfaces. The difference points to paths that never appear in an external count.

Plausible internal paths

A store network typically carries point-of-sale systems, back-office workstations, a building management platform and the refrigeration controllers. Compromise of any of those can reach the plant without a public controller interface.
CERT-FR's guidance addresses this indirectly. Its advice to restore remote access only through a secure VPN or protected network implies that such access exists and terminates inside the store, where it can be abused if the terminating host is compromised.

What that means for segmentation

The question is not only whether a controller is reachable from the internet. It is whether the controller can be reached from a workstation that is. Checks worth running:

can a back-office endpoint open a session to a controller port
do controllers share credentials with other systems
does the vendor's access path land on a shared jump host
are controller logs forwarded to something the store cannot delete

What the observed behaviour suggests

According to Le Monde, attackers kept some units in defrost mode for up to eight hours, which delayed alarms. That is deliberate manipulation of a control function, which implies the attacker understood the plant. Whether it came from the internet or from inside the store is not public.
Investigators were reportedly puzzled by the lack of a claim or a ransom demand, which is consistent with an objective other than extortion.

The measurement boundary

A ZoomEye query for title="StoreView Web" on 21 October 2026 returned 271 globally and 55 in France. Those figures describe the public boundary. The internal boundary has to be found from network data, not from an internet search.