French Supermarket Cyberattack: How Hackers Targeted Fridges

French Supermarket Cyberattack: How Hackers Targeted Fridges

By Binary-Tech Institute | 13 October 2026

A cyberattack on French supermarkets has shown how a digital breach can cause problems far beyond computers and websites. During the night of 11–12 October 2026, attackers interfered with refrigeration controls at stores across France. Fridges and freezers began to warm up, food was thrown away, and some shops had to close or take refrigerated displays out of service.

The incident is still under investigation. Here is what is known so far, how the refrigeration systems were affected, and what other organisations can learn from the attack.

What happened to the supermarket fridges?

Supermarkets use control systems to monitor and manage refrigeration equipment. These systems can let technicians check temperatures and change settings remotely.

In the French incident, attackers changed settings on some of these systems. Reports say refrigeration units were forced into prolonged defrost cycles, and some cold rooms reached temperatures of about 50°C. Once food had been exposed to unsafe temperatures, stores had to discard it to avoid breaking the cold chain.

The attack affected stores belonging to several chains, including Intermarché, Netto, Coopérative U, Carrefour, Monoprix and some E.Leclerc locations. The reported totals differ: France’s finance minister said around 700 supermarkets were affected, while Reuters reported at least 350. The full number was still being assessed on 13 October.

How did hackers get access?

French cybersecurity agency ANSSI said it was aware of compromises involving remote refrigeration controllers from Danfoss, Copeland and Dixell. The agency warned that leaving equipment management interfaces open to the public internet creates a security risk.

Danfoss said many affected systems were older or running outdated firmware, and some no longer received security updates. Researchers had previously reported vulnerabilities in some refrigeration-control products. However, investigators had not confirmed that a specific known vulnerability was the way attackers got into the systems used in this incident.

The attack also appeared to continue into the following night. On 12–13 October, some businesses using Dixell equipment reported further attempts to alter refrigeration settings. In one reported case, staff and technicians intervened before food had to be discarded.

What was the impact?

The most immediate impact was spoiled food and disruption to store operations. Some shops had to remove stock, temporarily close or keep display cases out of service while equipment was checked. One Intermarché owner told Le Monde that the stock loss at his store was about €21,000 at purchase cost. The overall financial cost had not yet been established.

The Paris prosecutor’s office opened an investigation into the attack, including reported food losses and fires. As of 13 October, there was no confirmed public attribution of the attack, and no group had claimed responsibility. Reporting had not established that customer data was stolen. France’s finance minister said the incident did not put the country’s food supplies at risk.

A separate cybersecurity issue also disrupted online services at supermarket group Ahold Delhaize. Reuters reported that Dutch authorities did not believe that incident was connected to the French refrigeration attack.

What can businesses learn from this attack?

The incident is a reminder that cybersecurity includes the equipment that runs buildings and services—not only laptops, email and websites. Refrigeration controllers, heating systems, cameras and other connected devices can affect day-to-day operations if attackers gain access to them.

ANSSI’s guidance for affected refrigeration systems includes removing exposed controllers from the public internet, checking their settings, updating supported firmware and changing default passwords. Where remote access is needed, the agency advises using a protected network or secure VPN. If a system has been compromised, simply resetting it may not be enough if it remains exposed or vulnerable.

Businesses can apply the same principles to their own technology:

• Keep an inventory of internet-connected equipment, including devices managed by contractors.

• Remove direct public internet access to device administration pages.

• Use secure, restricted remote access, such as a VPN.

• Update supported software and replace equipment that no longer receives security updates.

• Change default passwords and review who can access systems.

• Monitor for unexpected changes and make sure staff know how to respond.

The wider lesson

The French supermarket attack demonstrates how a weakness in a connected control system can lead to real-world losses. A compromised controller can affect food, equipment, staff and customers, even if the business’s main computer network is still working.

For every organisation using connected equipment, the practical question is: which devices can be accessed remotely, who is responsible for securing them, and what happens if they are suddenly controlled by someone else?

Sources and further reading

• France’s CERT-FR / ANSSI security alert on refrigeration controllers

• Reuters: Investigators hunt French supermarket fridge hackers

• Associated Press: Cyberattacks hit European supermarket chains and disrupt refrigeration systems

• Le Monde: A disastrous day for French supermarkets after cyberattack targets refrigeration systems