The French Supermarket Refrigeration Attack — The Night Remote Controllers Warmed the Food

On the morning of Monday 12 October 2026, staff at hundreds of French supermarkets opened up to find freezers that had spent the night heating instead of cooling. Nothing had been encrypted and no customer data had been taken. The target was the equipment itself: the controllers that keep a store's fridges, freezers and cold rooms at temperature.

The attack ran through the night of Sunday 11 to Monday 12 October. According to BFMTV, as relayed by AFP and the Associated Press, the attackers remotely triggered forced defrost cycles and set temperatures as high as 50°C. Les Mousquetaires, which owns Intermarché, told Reuters that fridges at around 150 of its stores were heated to 50°C for six hours overnight. Affected stores had to throw away the fresh and frozen products concerned to protect the cold chain, Intermarché told AFP.

Counting the Stores

The counts that circulated in the first two days do not add up to a single figure, partly because each retailer counted for itself and partly because a store "reached" by the attack did not always lose its stock.

Euronews, citing Reuters on 14 October, put the figure at a minimum of 350 supermarkets. Schelcher said most of the U stores hit managed to keep refrigeration going and only some had to discard food. No official total of the losses has been published; Intermarché's chief executive Thierry Cotillard told BFMTV he expected tens of millions of euros nationwide in a single day, and Intermarché told AFP that its insurance did not cover this kind of incident in stores.

The Equipment and the Alert

A source close to the case told AFP that refrigeration control systems from the Danish manufacturer Danfoss were the target. On 12 October CERT-FR, the incident-response arm of the national cybersecurity agency ANSSI, issued alert CERTFR-2026-ALE-012, saying it was aware of numerous compromises of remote controllers for refrigeration installations: the Danfoss AK-SM and AK-SC series and, in a version added on 13 October, Copeland xweb and Dixell xweb. The alert was updated again on 16 October.

Its advice was blunt. Exposing a management interface on the internet runs against good practice; operators should remove internet exposure for these units and for any unit on a public IP address, check the defrost settings, and restore remote access only through a secure VPN or protected network. It warned that attack campaigns against this equipment were probably still under way, and that an internet-exposed device without security fixes — end of life — faced a very high probability of compromise. A factory reset alone would remove an attacker's persistence but leave the device vulnerable to being compromised again.

Danfoss told AFP that most of the affected equipment was legacy products that no longer receive software or security updates, naming the AK-SM800 and AK-SC355, and that a version of the former was running outdated firmware. To Reuters it said it was "aware of incidents in France affecting a limited number of refrigeration management systems" and that it had long advised customers to keep supported systems updated and to migrate legacy systems. Danfoss gave no figure for how many systems were affected.

The way in has not been officially described. A person close to Prime Minister Sébastien Lecornu told AFP that ANSSI had identified a vulnerability in software supplied by a Danish company and contacted the vendor; that statement named no CVE and did not say the flaw was used in the attack. Researchers at Claroty had published flaws in the newer AK-SM 800A in August, since fixed, and Reuters counted at least 4,500 Danfoss interfaces visible online on 13 October. Neither French authorities nor Danfoss linked that research to the attack.

Investigation and Political Response

The Paris prosecutor's office told AFP it had opened an investigation on its own initiative into the large-scale cyberattack on the connected refrigerators of several major food retailers across France. The case is led by its cybercrime section and assigned to the anti-cybercrime office, OFAC, with the aim of identifying the victims and establishing the link with the losses they reported, including food and outbreaks of fire.

According to the Prime Minister's entourage, Lecornu immediately asked ANSSI to take up the matter and was following the file personally. ANSSI was in contact with its European counterparts because other countries might be affected. Félix Aimé, a threat-intelligence analyst at Sekoia, told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected, without further detail. The EU agriculture commissioner Christophe Hansen condemned the attack. On 13 October Lescure told the National Assembly there was no risk to France's food supplies.

As of mid-October no group had claimed responsibility. Investigators had seen no ransom demand, which Euronews reported had puzzled them. A separate cybersecurity incident at the Dutch retailer Ahold Delhaize began the same weekend; the Dutch National Cyber Security Centre said it saw no link to the attack in France.

Why It Matters

Most entries on this site's cybersecurity timeline are about data or about computers that stop. This one is about heat. Stuxnet showed in 2010 that a state could build malware to damage physical equipment; the French incident shows the same class of outcome arriving at the most ordinary end of operational technology — a store's refrigeration panel, managed remotely so that a maintenance contractor can adjust it from anywhere.

The common thread in the official accounts is not an exotic exploit but exposure and age: management interfaces reachable from the public internet, many of them on hardware the vendor no longer patches. Coopérative U's stores, Schelcher noted, did not buy from Danfoss at all; they were customers of refrigeration contractors who supplied the system. That chain — retailer, contractor, controller, vendor — is where responsibility for an internet-facing device fell between the gaps. The investigation had not reported its findings at the time of writing.