Fridges against supermarkets: how hackers spoiled the food in hundreds of French stores in one night
On the night of 12 October 2026, refrigeration equipment in hundreds of French supermarkets was remotely switched into defrost mode. By morning the display cases had warmed to 50 °C, the food had to be thrown away and losses ran into millions of euros. The attack went through controllers that were exposed to the internet and hadn't been updated for years.
---
## What happened
On the night of 11 to 12 October 2026, someone remotely switched the refrigeration equipment of hundreds of French supermarkets into **continuous defrost mode**. When staff opened the stores on Monday morning, the display cases and cold rooms had warmed to almost **50 °C**.
The Intermarché in La Haye, Normandy, was hit hardest: according to the store, the temperature reached **80 °C** and some equipment melted.
The attack was well thought out. According to Le Monde, the defrost cycle was stretched from one hour to eight, to delay the alarms for as long as possible. The alarms did stay silent, and at night there was almost nobody in the stores.
## The scale
- **Intermarché and Netto** — about 300 stores according to AFP; the Les Mousquetaires group itself speaks of about 180;
- **Coopérative U** — about 100;
- **Carrefour** — 80;
- **Monoprix** — about 30;
- **E.Leclerc** — "several" stores.
In total, according to various estimates, up to **700** supermarkets were affected. Fresh and frozen food had to be thrown away.
Estimates of the damage differ. Les Mousquetaires expects losses of "several million euros". Intermarché CEO Thierry Cotillard speaks of "tens of millions of euros nationwide in a single day". Possible fires were also reported, but Les Mousquetaires denies this: according to the group, the equipment smoked but there were no fires.
## How it was possible
The hackers didn't break into the fridges themselves but into the **controllers** that run them. These are industrial devices made by the Danish company Danfoss, models AK-SM800 and AK-SC355. According to Danfoss, most of the affected devices are outdated and **no longer receive security updates**: the AK-SC355 was discontinued in 2016 and the AK-SM800 in 2021. Danfoss had already warned about security issues in these controllers in March 2025. The French agency CERT-FR reported that Copeland and Dixell systems were affected too.
The main problem is that **the web management interface of these controllers was exposed to the internet**. CERT-FR calls this setup a plain breach of basic security practice: remote management should only be reachable from trusted addresses. According to researchers, the service login to the devices is also protected by a predictable password.
On top of that, E.Leclerc reported that one of its refrigeration equipment suppliers had been compromised. So the attackers may also have used a contractor's access.
One more figure explains why France in particular was hit. According to U.K. Cyber Defence, cited by TIME, France accounts for almost **60%** of all internet-exposed Danfoss controllers in the world.
## Who is behind it
Unknown. Nobody demanded a ransom and nobody claimed responsibility.
The Paris prosecutor's office opened an investigation, and Prime Minister Sébastien Lecornu tasked the national cybersecurity agency ANSSI with investigating and coordinating with other European countries. Coopérative U CEO Dominique Schelcher called the attack "unprecedented" and "unacceptable". EU Agriculture Commissioner Christophe Hansen wrote: "Food security requires more attention at all levels."
In early November there were reports of similar attacks on supermarket refrigeration systems in Belgium, the Netherlands, Sweden, Ireland, Portugal and other European countries. Details are still scarce.
## Why this isn't only about supermarkets
A supermarket fridge isn't just hardware — it's a computer connected to a network. Almost every company has devices like that: ventilation and air conditioning systems, controllers in warehouses and on production lines, video cameras, access control systems, smart meters. Contractors install them, configure them once and don't update them for years. Often the company doesn't even know they are reachable from the internet.
What follows from this:
1. **You need a full list of connected devices**, not just computers and servers. You can't protect what you don't know about.
2. **Equipment management interfaces must not be exposed to the internet.** Remote access only through a VPN and only from trusted addresses.
3. **Outdated equipment that no longer gets updates should be replaced or isolated** in a separate network segment.
4. **Contractor access must be controlled**: who connects to your equipment, from where and when.
5. **Someone has to notice suspicious configuration changes around the clock.** In this attack the damage built up over one night while nobody was watching.
## The bottom line
Hundreds of stores lost their stock not because of a sophisticated hack, but because the equipment that controls the cold was reachable from the internet and hadn't been updated for years. Almost every company has "forgotten" devices like these — and attackers search for them automatically.
[Vulnerability management](/services/vulnerability) helps find internet-exposed devices and weaknesses before attackers do, and [24/7 SOC monitoring](/services/soc) helps spot suspicious activity in time. If you want to know what part of your network is visible from the internet, [get in touch](/contact).
---
*Based on reporting by CBS News (AFP), CNBC, TIME, CNN, NBC News, franceinfo and Journal du Geek (13–14.10.2026) and a CERT-FR alert. The investigation is ongoing; figures and details may change.*