Hackers pushed supermarket fridges to 50 °C — how did old controllers put France's food shelves at risk?

On the night of Sunday 11 to Monday 12 October 2026, the fridges in hundreds of French supermarkets began to warm up. Attackers had remotely triggered the forced defrosting of the refrigeration systems, BFM TV reported, according to AFP. In some installations the temperature reached 50 °C, Le Monde Informatique reported.

By Monday, Intermarché was telling its affected branches to “throw away all of the products” that were fresh and frozen.

Why does an attack on fridges matter?

Because it went straight from a computer network to the food supply. Dominique Schelcher, chief executive of Coopérative U, called the attack “unprecedented” and wrote: “It is unacceptable.” The EU's agriculture commissioner, Christophe Hansen, wrote that “food security requires more attention at all levels.”

The Paris prosecutor's office said the attack also sparked fires.

What was hit?

The targets were refrigeration control systems made by the Danish manufacturer Danfoss, which regulate temperatures, defrost cycles and remote operation. Danfoss said most of the affected units were “legacy” products that “no longer receive software or security updates”, naming the AK-SM800 and AK-SC355 controllers, according to AFP.

On the Monday, the chief executive of the security firm Predicta Lab, Baptiste Robert, found 2,752 Danfoss systems exposed on the internet, 1,590 of them in France, BleepingComputer reported. In 2025 the US cyber agency CISA warned of two flaws in Danfoss AK-SM 800A management interfaces, one allowing authentication to be bypassed. BleepingComputer did not confirm that either flaw was used in this attack, and said no information was available on how the controllers were compromised.

How many shops were affected?

Every count comes from a different source, and they do not match:

• Intermarché and Netto: at least 300 shops, according to AFP; about 180, according to the group's own statement to CNBC, cited by Forbes.
• Coopérative U: over 100 outlets (AFP); fewer than 100 (Le Monde Informatique); 80, according to the company (Forbes).
• E.Leclerc: several stores; it said a cyberattack had “affected one of its refrigeration equipment suppliers”.
• Monoprix: about thirty stores, according to Le Monde Informatique. Carrefour Market was also named in reports.
• In total: 250 to 350 stores (French outlets cited by BleepingComputer); nearly 400 (BFM TV, cited by Le Monde Informatique); at least 350 (Forbes).

What did it cost?

Thierry Cotillard, president of the Mousquetaires group that owns Intermarché, told BFM TV he expected losses of several tens of millions of euros nationwide in a single day, Forbes reported. Schelcher said the damage could reach tens of thousands of euros for a small shop and more than €200,000 for a larger one. Intermarché said insurance does not cover this kind of in-store incident.

Who is investigating?

The Paris prosecutor's office opened an investigation into “the large-scale cyberattack affecting the refrigerators of several major food retail chains across France”. It has been assigned to the national anti-cybercrime office (Ofac) under the prosecutor's cybercrime section, and aims to identify victims and link the attack to the food losses and fires they report.

Prime Minister Sébastien Lecornu asked France's national cyber agency, ANSSI, to take up the case, according to his entourage. A source close to Lecornu told AFP the agency had found a vulnerability in the Danish company's software and contacted the vendor.

What we do not know

• Who did it. No group has claimed the attack and none has been reliably identified, as of the reports we opened (13–14 October 2026).
• How they got in. Whether known flaws, weak access controls or something else was used has not been made public.
• The real scale. Store counts range from about 250 to nearly 400, and the chains' own figures differ from those in the press.
• The fires. The prosecutor mentions them, but the sources we opened give no details of where or how serious they were.

What to watch

Former UK cyber chief Ciaran Martin called it one of the strangest cyber events he had seen; Ken Munro of Pen Test Partners told Reuters it was mainly a matter of basic digital hygiene. The investigation will show which of the two is closer to the truth. Either way, the lesson for every operator of connected equipment is the one Danfoss itself gave: hardware that no longer gets security updates, left reachable from the internet, is an open door.

Sources

• AFP via Khaleej Times: French supermarkets suffer refrigerator shutdown after 'unprecedented' cyberattack (12 October 2026)
• BleepingComputer: Cyberattack shuts down refrigerators at French supermarkets (12 October 2026)
• Le Monde Informatique: Une cyberattaque perturbe les installations frigorifiques de centaines de supermarchés (13 October 2026)
• Forbes Belgique: Cyberattaque contre des supermarchés en France (14 October 2026)