Three weeks ago we wrote about the French supermarket fridge hack — more than 300 stores whose refrigeration units were driven to ~50°C overnight, spoiling food and, in several cases, catching fire. The uncomfortable core of that story was that it wasn’t a sophisticated zero-day: the Danfoss controllers had a known vulnerability with a vendor fix available roughly 18 months earlier. The patch existed. It simply wasn’t applied.
On Monday, November 2026, it happened again.
According to the Financial Times, freezers at dozens of supermarkets across Sweden, Belgium, Ireland, Finland and Estonia suddenly overheated after attackers broke into their refrigeration systems a second time in a matter of weeks. Units at Ica and Coop stores in Sweden were pushed as high as 55°C; equipment at Ahold Delhaize, Carrefour, Intermarché, Spar and Ikea in Belgium, Supervalu in Ireland, K-stores in Finland and Selver in Estonia was also hit. Food worth millions of euros was ruined. Belgium’s national cybersecurity centre has upgraded the incident to a national-level event. (Financial Times)
The vendor was the same: Danfoss, which confirmed its systems had been compromised for a second time and repeated the guidance it had already issued — disconnect from public IP addresses, update to the latest firmware, and use proper network protection. The attack method was the same class of problem, too: equipment reachable over unsafe internet connections, with the freezers’ defrost mode turned against them.
In other words: the warning was public, the fix was known, and a second wave still landed.
The one retailer that was mostly spared tells the whole story
Buried in the reporting is the single most important detail for anyone who runs IT or security at scale. Carrefour’s Belgian spokesperson said that only a small number of its stores were affected — because of measures the company took after the French incident, including applying updates and using a secure connection.
That is a real-world A/B test, run live across the European retail sector:
- Stores that applied the updates and closed the internet exposure after the first attack were largely untouched.
- Stores that didn’t were hit again — same vendor, same weakness, weeks later.
Nothing exotic separated the two groups. No next-generation defense, no threat-intelligence breakthrough. The difference was patch discipline and exposure management — applied quickly, and applied everywhere. That is the entire thesis of modern patch management, demonstrated at someone else’s expense.
Why “just patch it” keeps failing — and why AI makes it worse
If the fix is known and the vendor is shouting about it, why does a second wave still succeed? The same reason the first one did: scale, distribution and isolation. A retailer like this runs thousands of systems across dozens of operating systems, hundreds of physical sites, and segmented or air-gapped networks where opening a firewall rule for every endpoint is its own project. Patching one server is trivial. Patching all of them, in the right order, across isolated sites, fast enough to beat the exploit — and proving it — is where an 18-month-old fix falls through the cracks twice.
And the window to act is closing faster than ever. Robert Lee, CEO of OT security firm Dragos, told the FT that large language models are now putting the expertise and tooling to attack industrial systems within reach of far more attackers — letting them hit many devices and sites simultaneously. “The reach and scale of these attacks is new,” he said: where operational-technology intrusions were once one-off events, we are now seeing hundreds of sites compromised at once. The time between “weakness known” and “weakness weaponized against everyone at once” is collapsing — and AI is the accelerant.
Where JetPatch actually changes the outcome
Let’s be precise about this, because it matters. JetPatch does not flash the firmware inside a Danfoss freezer controller — an embedded OT device has no agent, no shell and no package manager for a general-purpose tool to use. (We covered that honest boundary in detail in Part 1.)
What JetPatch does is close the gap that actually spared Carrefour — across your entire estate, automatically:
- Patch everything that runs an OS, fast. From a single console, JetPatch orchestrates patching across 20+ operating systems — Windows, a dozen Linux distributions, Solaris, AIX — prioritized by real CVE risk, sequenced from test to production, validated, and rolled back automatically on failure. When a vendor ships a fix, it reaches every affected system in days, not never.
- Kill the internet exposure the attackers used. The JetProxy gateway lets one console reach and patch endpoints across remote sites, DMZs, hybrid cloud and segmented networks — without per-device firewall rules open to the internet. That directly answers Danfoss’s own advice to get systems off public IP addresses.
- Protect the layer attackers really pivot through. The HMIs, engineering workstations, historians, jump hosts and DMZ servers surrounding the controllers are standard IT — and they are exactly where intrusions like this live. Those are continuously patchable with JetPatch.
- Prove it to an auditor. Every rollout carries the scheduling, approval and compliance reporting that regulated and OT-adjacent change windows demand — so “we applied the update everywhere” is a report, not a hope.
The takeaway
The French fires were a warning. The second wave is the proof that warnings aren’t enough on their own. Danfoss told its customers exactly what to do — and the retailers who did it stayed cold while the ones who didn’t lost their stock a second time.
The gap between those two outcomes isn’t luck or budget. It’s whether patching and exposure management happen automatically, everywhere, and fast enough to beat an AI-accelerated exploit. That’s not back-office housekeeping anymore. As we said last time: it’s fire prevention.
See how JetPatch closes the patch-and-exposure gap across your entire estate — including remote sites, DMZs and air-gapped networks. Request a demo →
