On the night of 11 to 12 October, the refrigeration systems in hundreds of French supermarkets received new instructions, and obeyed them.
Attackers took control of refrigeration controllers and locked the units into continuous defrost, driving temperatures up to around 50°C. By morning, the chilled and frozen food in those stores was ruined. Reports put the number of French stores hit as high as 700, with Intermarché and Carrefour among the chains named, and losses ran into the millions.
The controllers at the centre of it were refrigeration regulators made by Danfoss, the Danish industrial manufacturer, including the AK-SM 800 and AK-SC 355. In Danfoss's own statement, most of the affected equipment was older product running outdated software or past the end of its supported life.
Then, on 2 November, it happened again. A second wave of temperature spikes was reported by retailers in Belgium, Luxembourg, Sweden, Estonia and Ireland, with the same defrost method.
Nobody broke down a door. Nobody needed to. The machines were connected, they were listening, and they did what they were told.
What actually failed
Strip away the headlines and this attack is almost boringly simple, which is precisely what makes it important.
The refrigeration controllers were internet-connected machines with the power to take consequential physical action: in this case, destroying a store's entire cold inventory in a single night. They accepted remote instructions without meaningful verification of who was issuing them or whether those instructions were authorised. There was no authorisation trail for the commands that mattered, nothing that could answer, in the moment or afterwards, the basic question: who told you to do that, and were they allowed to?
The weaknesses were not secrets either. Claroty's Team82 published research in August on flaws in Danfoss controllers, including a hidden login that could give an attacker administrator access. Investigators have not confirmed which weakness the attackers used, but the class of problem was public two months before the attacks, sitting in legacy systems nobody was continuously watching, because in most estates nobody's job is to watch continuously. An inventory is taken. A report is filed. The estate moves on; the report doesn't.
Why traditional security misses this
The traditional security model was built for a slower world: an annual assessment, a point-in-time pentest, an asset inventory printed and filed. Each of those artifacts starts going stale the day it is produced. Connected estates (cloud accounts, SaaS, devices, and now software agents) change daily, and attackers do not wait for your next scheduled review.
A controller that was "acceptable risk" in last year's inventory is this year's headline. A weakness published in August is a weapon by October. Point-in-time security cannot see a moving target, and inferred risk scores cannot tell you whether a known hole is actually reachable and exploitable in your estate or just theoretical. The gap between the assessment and the attack is where modern incidents live.
How Redthread fights this pattern
Redthread is an AI-native application protection platform, built around two convictions: security has to be continuous, and findings have to be proven.
Our assessment platform is agentless-first: it installs nothing in your estate to get started. It begins by building one context graph of everything you run (applications, code, cloud accounts, machines, identities, and the data they can reach), presented in Redthread Flow, where attack paths are ranked by severity and labelled honestly: "proven" means our engine executed and confirmed a step on that path; "potential" means it exists in configuration but was not executed. Every module works from that same map.
Instead of an annual snapshot, it assesses continuously. Connecting is deliberately boring: a website needs no credentials, GitHub is one click, each cloud connects read-only in one click, and endpoint sensors install with one command and only ever watch, never block. The scan discovers what you actually run, including shadow AI and exposed systems nobody registered; maps cloud posture and sensitive data stores (DSPM); and builds cross-cloud attack paths, so risk is ranked by how an attacker could actually move through your environment, not by isolated finding counts. Where the platform reports a vulnerability, it validates the finding by exploiting it and producing a reproducible proof of concept: proof that a hole is real, never an inferred score. CI/CD gating blocks new proven attack paths before they ship, continuous re-assessment catches what changes after deployment, and remediation support plus Letters of Attestation give your team, and your customers' security reviewers, evidence that holds up.
Our second product, the Agentic Trust & Protection Platform (ATPP, at trust.redthreadsec.com), addresses where this failure pattern goes next. The fridge controllers were machines that acted on instructions. AI agents are the new machines that act on instructions, except they browse, buy, write code, move data and call tools at a scale and speed no refrigerator ever approached. ATPP gives every agent a cryptographic identity bound to its build, verifies identity and tool claims at call time (at the moment of action, not in a report afterwards), and issues delegation receipts that prove who authorised what. When a tool drifts from what was approved, revocation propagates. And because the agent supply chain is already being abused in the wild, we run a daily signed scan of the entire MCP registry, with each day's signed manifest anchored in the public Sigstore Rekor transparency log, so our claims can be checked too. Our 2 November scan covered 55,375 servers in the official MCP registry and found 1,518 listing swaps, where the code behind a listing changed hands under the same name. The enforcement gateway that acts on these signals inline is in preview; the identity, verification and evidence layer is live.
The supermarkets' question, who told this machine to do that, is about to be asked of every enterprise AI deployment. We build the layer that can answer it.
Build it with us
We are a young company with production systems and a specific conviction: the next decade of security is about verifying machines, not just patching them. We are opening two to three founding design-partner slots for teams who want to harden this technology in the field with us. The pilot is free for 30 to 45 days, and founding-partner pricing is deeply discounted and locked for the partners who join now.
Or start simpler: run the free self-serve estate scan and see what continuous, proven assessment finds in your environment. The machines are already taking instructions. Make sure they're yours.