Somewhere in your plant there is equipment that a contractor looks after and reaches from outside. It was put there for a good reason, and it has worked for years. Depending on your resources and setup, nobody may be paid to ask whether the arrangement still holds up against today’s threats. When it goes wrong, the bill is yours.
Several hundred French supermarkets learned this in one night in October 2026. Attackers took over the store controllers that ran their refrigeration. By 14 October, investigators had not said how they got in. The national cyber agency’s alert points to controllers left reachable from the internet. The chilled and frozen stock was lost. One chain CEO put the national cost at tens of millions of euros in a single day.
The technical explanation fits in one line: old controllers on the internet with a weak login. That is true. But it says nothing about the choice the store owners actually had.
From what has been published, nobody weighed that choice. The owners assumed it was taken care of, and nobody in the chain was paid to bring it to them.
What the owner faced
Two roles need keeping apart here. The operator runs the store day to day. That is the store manager and the staff who keep the cabinets stocked and cold. The owner holds the budget, signs the maintenance contract and the insurance, and carries the loss. In a small independent store they can be one person. In a chain the owner may sit at head office. The operator inherits whatever the owner agreed to, as the same split in plant engineering shows.
The operators were the first to see the damage. At one store the alarms fired in the night and the staff found warm cabinets in the morning. They did what operators do. They emptied the cabinets and called the contractor. None of them had chosen the arrangement.
The connection was there for a reason. It protected the stock against the cooling failures that happen every year. The risk it opened had not yet happened in France. Where a contractor was in place, it monitored the cabinets and responded to alarms. The stores had the temperature record that food safety law expects. The insurance and the maintenance contract may both have assumed the monitoring was on. Even the national cyber agency’s alert tells owners to check their insurance terms before cutting the link to the contractor.
Cutting the link would have saved the monthly maintenance fee and closed the way in from the internet. It would also have lost the alarm and the record. And the decision may not even have been the owner’s alone. The insurer and the contractor may have had a say.
Replacing the controller had a cost too. This is not replacing the fridges. The cabinets and compressors stay. What changes is the controller that supervises them, usually one or a few per store. Even so it meant capital per store and a contractor visit. It also meant warm cabinets during the changeover, for a controller that still worked. The arithmetic that looks absurd today was normal the day before.
Updating the firmware on the newer controllers was the cheaper fix. It was not a simple one. An update needs a planned window and a contractor on site. It can break other systems that talk to the controller. Some updates cannot be rolled back. So the people who run these systems tend to put updates off. According to the manufacturer, the newer controllers that were hit still ran outdated firmware.
The only technical adviser in the room was the contractor. The contractor’s own remote access and service revenue were what the decision was about. Nobody independent of the contractor was looking at the arrangement.
There was a third option between keeping the open connection and cutting it. The controller could come off the internet and sit on its own network, apart from the tills and the office. The contractor would reach it through a protected connection instead. The controller would still send the alarm, and the store would keep its temperature record. The national agency recommends taking the controllers off the internet. According to the manufacturer, every store hit in an earlier attack in Israel in 2022 lacked a firewall or a protected connection. The option also works on controllers past support, where no update exists. It still has a price. The contractor has to agree to work that way, and someone has to set it up.
So each choice had a price on both sides. The owner’s real option was to consider the trade-off explicitly. The alternative was to let whoever reached the equipment first decide it.
Why you have to ask
On the business side the case has been read in three ways. It was the cost of doing business. It was a lack of competence and understanding. It was poor risk management. All three readings assume someone weighed the choices and made a call. From what has been published, nobody did. The likeliest reading is that the owners assumed it was taken care of. Everyone around them had a reason to let that assumption stand.
In short, a risk explicitly considered has a name, a reason and a date. It can be revisited when the facts change. A risk you assumed was taken care of has none of those. From the outside the two look the same until the day of the loss.
The decision still had an owner. As I see it, whoever bears the harm owns the risk, whether or not anyone wrote it down. Nobody else in the chain will bring it to you.
The people who knew were not the people who lost. From 2025 the manufacturer published fixes and advice to migrate. A US government agency published advisories in May and August 2025. The research firm that found the weaknesses published its details in August 2026. None of them had a reason to call a store owner. Store owners rarely read manufacturer advisories. An owner who didn’t ask never heard.
The contractor holds the login and has little reason to raise the issue. Telling a customer that the controller you installed is exposed can sound like an offer to fix it for free. That is a governance problem in the supplier relationship, not a technical one.
End-of-life is the manufacturer’s support status. It is not the end of the asset’s life. According to the manufacturer, many of the controllers hit were past support and had no fix available. They kept running because they still worked. The exposure stayed with the owner. This is the same depreciation gap that sits under most OT patching problems.
The choice after the attack
The obvious fix did not get easier once it became obvious. It got a deadline. On 13 October the agency said the attacks were probably still running. It also said a reset controller past support would be compromised again. Well over a thousand controllers in France now need isolating or replacing. The contractors have limited capacity, and the cabinets must stay cold meanwhile. Each owner is now choosing a place in a queue.
What this means for your own plant
Every maintenance contract with remote access is a decision somebody made for you. It was usually made at commissioning, which is where resilience is decided. It is rarely revisited.
A plant rarely has only one contractor with a way in. Refrigeration, ventilation and the building systems may each have their own. Each one is a separate decision of the same kind.
For equipment past support, keep two documents apart. The manufacturer’s support calendar belongs to the manufacturer. Your asset register belongs to you.
The owner is the one who has to ask. The operator lives with the answer but cannot change the contract. Ask in stock, production hours and contract terms, not vulnerability numbers. Accountability stays with the business, however much of the work is outsourced. And where the insurance terms depend on the monitoring, the insurer can also reward the isolation in the premium. Someone has to put it to them.
The questions end in the contract. I would write four clauses into every maintenance contract with remote access:
- The contractor passes on the manufacturer’s advisories within an agreed time.
- The contractor keeps an inventory of every remote access path to the equipment it looks after.
- Remote access runs only through a protected connection, with named accounts and a log.
- The contractor gives notice before any equipment goes past support.
What the owner pays for
The loss landed on the owners, though nobody had put the decision in front of them. The knowledge sat with the manufacturer and the access with the contractor. That split is the business exposure in contractor-connected equipment.
A risk explicitly considered can be priced. The owner can set it against the maintenance fee, the replacement capital and the insurance premium. A risk you assumed was taken care of is priced only once, on the day of the loss. Until then it looks free to everyone in the chain.
Deciding late also costs more than deciding early. Before the attack, the owners could choose when to pay. Afterwards they pay when a contractor is free.
I advise industry and energy companies on security governance and risk management. I can help you work through this decision with your contractors and your insurer, or assess the contractor-connected equipment in your plant. Get in touch for recommendations you can act on. More about my work.