French Supermarket Hack Heats Fridges to 50°C, Sparks Fires

Hackers hijacked internet-connected refrigeration controllers at hundreds of French supermarkets overnight on October 11–12, 2026, remotely triggering defrost cycles that pushed some fridges and freezers to roughly 50°C for up to six hours. The attack spoiled fresh and frozen stock at stores run by Intermarché, Carrefour, Monoprix and other chains, sparked fires at some locations, and prompted Prime Minister Sébastien Lecornu to order France's national cybersecurity agency, ANSSI, to investigate alongside the Paris prosecutor's cybercrime unit.

What happened to French supermarket fridges

Multiple French supermarket groups reported on October 12 and 13 that connected refrigeration equipment across their stores had been remotely tampered with overnight, in what the Paris prosecutor's office described as an incident causing both food losses and fires. Rather than simply cutting power or disabling the systems, the attackers appear to have abused a legitimate defrost function built into commercial refrigeration controllers — triggering it continuously instead of on its normal schedule, which drove internal temperatures toward 50°C in units that are typically held between -18°C and 4°C. Chains said they had to discard large quantities of fresh and frozen food as a result, and several outlets reported fires breaking out at affected stores, consistent with overheated compressors and electrical components in units that were never designed to run at those temperatures for hours at a stretch.

Les Mousquetaires, the retail cooperative that operates the Intermarché and Netto banners, said fridges at roughly 150 of its stores were pushed up to 50°C for about six hours. Intermarché's leadership estimated the group's losses at tens of millions of euros for the single night, a figure that has not been independently verified. Carrefour said around 80 of its roughly 6,000 French supermarkets were affected, with the rest of its network untouched. Monoprix said about 5% of its roughly 490 stores were hit. Coopérative U was also named in multiple reports as affected, and E.Leclerc was mentioned in some coverage, though it had not confirmed an incident at the time of the earliest reporting.

How many stores were affected, chain by chain

Store counts moved as the story developed, and figures from individual retailers do not always match the broader numbers cited by French officials. The table below reflects the figures retailers and officials had given as of October 13–16.

The gap between the sum of individual retailers' figures and the roughly 700-store national estimate reported by wire services suggests either that additional, unnamed chains were affected, that some retailers' counts were still preliminary, or both. None of the companies named has disputed the broader government figure.

How hackers turned fridges into furnaces

Commercial refrigeration in large supermarkets is rarely managed fridge-by-fridge. Instead, a central controller — in this case, Danfoss's AK-SM "system manager" and AK-SC series devices — monitors and governs dozens of refrigerated cases and walk-in units per store, scheduling routine defrost cycles so that ice doesn't build up on evaporator coils. Those controllers are commonly connected to the internet or to a store's network so that refrigeration contractors can monitor temperatures remotely and get alerted to failures before food spoils.

That same remote-access capability is what reportedly let attackers intervene. According to security researchers and officials cited in wire reporting, the attackers gained access to internet-exposed controllers and forced them into a continuous defrost state rather than the brief, scheduled cycles the equipment normally runs — effectively commanding the units to keep heating instead of cooling. The precise method used to get into any individual controller has not been made public, and CERT-FR's alert does not tie the incident to one specific vulnerability. But the pattern matches a class of weaknesses that security researchers had already flagged in the same product lines.

The Danfoss vulnerability behind the incident

Months before the attack, industrial-security firm Claroty's Team82 research unit published findings on authentication and command-injection flaws in Danfoss's AK-SM 800A refrigeration controllers. The most serious, tracked as CVE-2025-41450, was an improper-authentication bug: the controller generated its daily one-time login password from the current date and time using a predictable algorithm, which researchers said could let an attacker calculate valid credentials and bypass login entirely. A related flaw, CVE-2025-41451, allowed an authenticated user to inject operating-system commands through the device's alarm-notification settings, opening the door to full remote code execution. The U.S. Cybersecurity and Infrastructure Security Agency published both in its ICS advisory ICSA-25-140-03, rating the command-injection issue up to 8.7 on the CVSS v4 scale. Danfoss's own security advisory on the authentication flaw credited the disclosure and pointed customers to firmware R4.2 as the fix, with R4.3.1 addressing the remaining issues.

Danfoss told reporters that most of the equipment affected in the October attack was "legacy" hardware that no longer receives software or security updates, and that the units involved "were running outdated firmware." The company said it had "long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions." It did not give a figure for how many systems were compromised, and it has not publicly confirmed that the October incident exploited the specific flaws Claroty disclosed, rather than some other weakness in the same product lines.

ANSSI and CERT-FR's response

CERT-FR, the incident-response arm of ANSSI (the Agence nationale de la sécurité des systèmes d'information), published alert CERTFR-2026-ALE-012 on October 12, saying it was aware of "numerous compromises" affecting Danfoss AK-SM and AK-SC controllers. The agency updated the alert on October 13 to add other targeted equipment, including Copeland xweb and Dixell xweb controllers, and again on October 16 to revise its recommendations — a sign that the agency's understanding of the intrusion's scope was still evolving days after the initial reports.

CERT-FR's guidance to operators was blunt: immediately remove internet exposure for affected controllers, or at minimum restrict access to a secure VPN rather than a public IP address; review defrost schedules and full device configuration for tampering; apply available firmware updates and enable stricter security modes; and, for any device suspected of compromise, perform a full factory reset and reconfiguration rather than a simple reboot, since a reset alone removes persistence mechanisms but doesn't fix the underlying exposure. The agency warned that attack activity against these devices was "likely still ongoing" and that end-of-life controllers left reachable from the internet carried a "very high risk" of compromise. Prime Minister Lecornu's office said separately that ANSSI had identified a vulnerability in software supplied by Danfoss, without specifying which one.

The Paris prosecutor's cybercrime section opened its own investigation, which French media reported had been assigned to the Office anti-cybercriminalité (OFAC). As of this reporting, no individual or group has been publicly named as a suspect, and investigators have not disclosed a motive.

Did the attack reach beyond France?

Some reporting has suggested the campaign wasn't confined to France. Felix Aime, a researcher with threat-intelligence firm Sekoia, was cited in wire coverage saying the attack had also affected targets in Spain, Portugal, Poland, Germany and Belgium. That claim has not been corroborated by a national cybersecurity agency in any of those countries in the reporting reviewed for this article, and French officials' public statements have focused specifically on the French retail sector. Given that Danfoss sells the same refrigeration-control product lines across Europe, a wider footprint would not be surprising from a purely technical standpoint — any internet-exposed, vulnerable controller anywhere is a plausible target — but readers should treat the multi-country claim as a reported, sourced claim rather than an official finding until a government body confirms it.

A separate incident: Ahold Delhaize's "security issue"

Around the same period, grocery giant Ahold Delhaize disclosed what it called a security issue that forced it to take some systems offline, disrupting websites for brands including Stop & Shop, Food Lion and Albert Heijn; the company said stores remained open and that it had no evidence customer or employee data had been accessed. That incident is a separate episode we've covered in detail, and nothing in the reporting reviewed here ties it to the French refrigeration attack beyond rough timing. The two stories have been conflated in some casual coverage simply because they broke in the same news cycle; they involve different companies, different systems, and, as far as has been publicly established, different causes.

Why connected refrigeration became a target

Supermarket refrigeration sits in an uncomfortable middle ground between IT and operational technology (OT). It's industrial equipment — compressors, valves, defrost heaters — but it's increasingly managed like an IT asset, with web dashboards, remote firmware updates and always-on connectivity so that a refrigeration contractor states away can catch a failing compressor before a store loses a freezer case of food. That convenience is also the exposure: a controller built to let a maintenance vendor log in from anywhere is, by the same token, reachable by anyone who can find it and guess or bypass its credentials. Security researchers have for years pointed to large populations of exposed industrial and building-control systems sitting on the open internet; Claroty's research into the Danfoss line reportedly found thousands of similarly configured management interfaces reachable without additional network protections.

What makes this incident notable within industrial control system security isn't the novelty of the vulnerability class — authentication bypass and command injection are common, well-understood bug categories — but the physical consequence attackers chose to trigger. Where many OT intrusions are framed around espionage, ransomware, or shutting a process down, this attack instead used a completely legitimate device function (defrost) against its own purpose, turning a feature meant to prevent ice buildup into a mechanism for spoiling food and, reportedly, starting fires. That's a reminder that OT security isn't only about keeping attackers from disabling safety systems; it's also about the much larger set of "normal" commands a compromised controller is already trusted to issue.

Part of a pattern of infrastructure-adjacent attacks

This incident lands in a year that has already produced several high-profile stories about vulnerable, internet-facing enterprise and infrastructure software — including, earlier in 2026, a root-access zero-day in Ivanti Connect Secure that put VPN gateways at risk. Taken together, these stories point to a consistent weak point across industries: remote-management interfaces — whether for a VPN appliance or a supermarket's walk-in freezer — that are convenient for legitimate administrators and, when left unpatched or unsegmented, equally convenient for attackers.

What happens next

ANSSI's investigation, ordered directly by Prime Minister Lecornu, remains active, and CERT-FR's alert was still being revised as of October 16 — four days after the first reports — suggesting investigators are still mapping how many devices were touched and by what method. The Paris prosecutor's cybercrime unit has not announced any arrests or named a suspect. For retailers and other operators running Danfoss AK-SM, AK-SC, or similar refrigeration-management hardware, CERT-FR's near-term guidance is unambiguous: get these controllers off the open internet, restrict any remote access to authenticated VPN connections, update firmware to the latest supported release, and audit configurations — especially defrost schedules — for signs of tampering. Longer term, the incident is likely to intensify pressure on both retailers and industrial-control vendors to treat refrigeration and building-management systems with the same security rigor as core IT infrastructure, rather than as plumbing that quietly runs in the background until something goes wrong.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage