Hackers Turned Supermarket Fridges Up to 50C in 700 French Stores: What the Refrigeration Sabotage Means for Every Retailer

In the early hours of Monday 12 October 2026, employees arriving at hundreds of French supermarkets found their chilled and frozen cabinets warm. Someone had reached the remote controllers that manage in-store refrigeration, switched every unit into a continuous defrost cycle and, in many cases, set the target temperature to 50C. Meat, dairy, ready meals and frozen food were written off by the pallet. The Paris prosecutor's office has since reported fires at some sites.

Nearly three weeks on, the picture has grown rather than faded. On 29 October France's finance minister told parliament that around 700 of the country's 10,000 supermarkets had been hit, calling the attack a wake-up call that "touches the heart of our food security." The same week, Bloomberg Businessweek reported that pro-Russia hacktivist groups have been turning exposed industrial control screens into physical damage across Europe, and Europe's largest grocery group, Ahold Delhaize, was still restoring systems after a separate incident. Together they make the French attack the clearest warning yet that operational technology inside ordinary businesses is now a target, not just a risk register entry.

What Happened

The first reports came from the Groupement Les Mousquetaires, whose Intermarché and Netto chains lost cooling in around 300 stores overnight on 11 to 12 October. Thierry Cotillard, who leads the group, told BFMTV that the attackers had remotely defrosted every cold unit and raised the temperature to 50C. Coopérative U said around 80 of its stores were affected, Carrefour reported about 80 supermarkets, Monoprix around 30, and several E.Leclerc stores were hit, including one in the Tarn the following night. Dominique Schelcher, chief executive of Coopérative U, told RTL that a small store could lose tens of thousands of euros of stock and a hypermarket between 180,000 and 200,000 euros.

France's national cyber security agency, ANSSI, published alert CERTFR-2026-ALE-012 on 12 October and updated it on 13 and 16 October. It says CERT-FR is aware of "numerous compromises" of remote refrigeration controllers across four product lines: Danfoss AK-SM and AK-SC series units, Copeland XWeb and Dixell XWeb supervisors. The alert is unusually blunt. Exposing a management interface to the internet is described as contrary to basic security practice, the campaign is said to be "probably still ongoing", and any end-of-life unit left reachable is given "a very high probability" of compromise. A factory reset is not enough, the agency warns, because it removes the attacker's persistence but leaves the device just as vulnerable as before.

How the attackers got in

No exploit chain has been published, and the Paris prosecutor's cybercrime unit, OFAC, is investigating whether known vulnerabilities or simply poorly protected remote access were used. The public evidence points to the latter. Kevin Tellier of the French security firm Synacktiv told Public Sénat that his team found the controllers exposed during a 2023 audit of a major retailer, misconfigured for convenience, and reported an authentication bypass to Danfoss at the time. Two weeks before the attack his team found another exposed unit. Security researcher Baptiste Robert counted 2,752 Danfoss refrigeration systems reachable from the internet on 12 October, 1,590 of them in France, and Claroty, which disclosed flaws in the Danfoss AK-SM 800A in August, confirmed to Tom's Guide that exposed units were still online days later.

Danfoss said most affected units were older products that no longer receive software or security updates and that it has long advised customers to migrate. Copeland said the vulnerability sat in a discontinued, end-of-life generation of controllers. Both statements are accurate and both miss the point that matters for defenders: nobody needed a zero-day. ANSSI's director, Vincent Strubel, told operators it was urgent to disconnect the controllers from the internet or, at the very least, apply very restrictive network filtering, with remote maintenance only through a secure VPN.

Ahold Delhaize and the wider week

On the same Monday, Ahold Delhaize, the Dutch-Belgian group behind Albert Heijn, Delhaize, Etos, Gall & Gall, Stop & Shop, Food Lion, Giant Food and Hannaford, announced "a security issue within its network" and took systems offline as a precaution. By 19 October it had confirmed the outage was caused by "malicious actions of others", that websites and apps for most of its brands in Europe and the United States had been affected, that stores stayed open, and that its investigation had found no evidence that sensitive customer, employee or partner data was stolen. The company notified the Dutch National Cyber Security Centre and filed a police report. Albert Heijn's home delivery service restarted nearly two weeks after the incident began. Ahold Delhaize did not answer The Register's question about whether its incident was connected to the refrigeration attacks, and no link has been established.

Then on 27 October Bloomberg Businessweek published a feature on hackers sympathetic to Russia who have caused physical damage by manipulating exposed operator screens, with examples in Spain ranging from crematorium ovens to winery temperature controls. An advisory from the industrial security firm Red Tiger Security, published the same day, summarises the method: find a human-machine interface reachable over the internet through VNC, log in with a default, weak or absent password, and change setpoints, limits and alarms. As the advisory puts it, "no software vulnerability is needed." The joint FBI, CISA and NSA advisory it cites, co-signed by more than twenty partners including the UK's NCSC, names Cyber Army of Russia Reborn, Z-Pentest, NoName057(16) and Sector16 as the groups behind such activity. None of those sources connects the groups to the French supermarkets, and the French investigation has not attributed the attack.

Who Is Affected

The immediate victims are French grocers and their customers, but the exposure is European. The Danfoss AK-SM and AK-SC families and the Copeland and Dixell XWeb supervisors are standard kit in supermarkets, convenience stores, pharmacies, restaurant chains, hotels, food manufacturers and cold-chain logistics depots across the continent, including the UK. They are typically installed and maintained by a refrigeration contractor rather than the retailer's IT team, which is exactly why so many ended up on the public internet with remote access configured for the contractor's convenience.

The sector pattern matters too. Within one week European grocery retail saw a destructive attack on physical equipment in France and a disruptive IT intrusion at a group operating in the Netherlands, Belgium, central Europe and the United States. Cybergen's threat intelligence team has been following the same shift across the Nordics, where Norway raised its national cyber risk level to High on 28 October citing hybrid activity against critical functions. Food supply is on every national list of critical functions, and the supermarket attack shows how little sophistication it takes to disrupt it.

For UK organisations the question is not whether they run the same controllers. It is whether anything in their estate, from refrigeration and HVAC to access control, CCTV, lifts, generators and solar inverters, is reachable from the internet with a password the supplier chose. The honest answer, in most retail, hospitality, healthcare and logistics estates we see, is that nobody has checked.

Why It Matters

Three things make this incident different from the ransomware stories that usually fill this column. First, there was no ransom. The attackers did not encrypt files or steal data; they destroyed stock and damaged equipment. Christopher Whyte, an expert quoted by AP, noted that the absence of a demand makes the case unusual. An attack with no commercial motive is far harder to deter, and insurance built around data breach and business interruption may respond very differently to spoiled stock and fire damage caused by a remotely altered setpoint. CERT-FR itself tells operators to check their insurance terms before cutting the data link to their refrigeration contractor.

Second, the attack surface sat outside the security team's view. Refrigeration controllers do not appear in most asset inventories, do not run endpoint agents and are rarely in scope for penetration tests. They were put online by a third party, managed by a third party and, when the vendor declared them end-of-life, nobody owned the decision to replace them. The Fédération du commerce et de la distribution has publicly asked Danfoss and installers for full transparency, which is a polite way of saying retailers did not know what they were running.

Third, the regulatory ground is moving. The EU's Cyber Resilience Act, adopted in 2024, will require manufacturers of connected products to build in security and maintain it across the product's life, and NIS2 already treats food production and distribution as an important sector. In the UK, the Cyber Security and Resilience Bill will widen the definition of essential services and tighten incident reporting. A board that learns of exposed building equipment from a prosecutor's press release will struggle to show it took reasonable steps.

What To Do Now

Find every management interface reachable from the internet. Ask facilities, store operations and every maintenance contractor what they connect to remotely and how. Then verify it from the outside with an external attack surface scan rather than trusting the answer. Look for refrigeration and HVAC controllers, building management systems, VNC and remote desktop ports, cellular modems and the small remote access boxes integrators leave behind. CERT-FR's first instruction for every affected product is simply to remove the internet exposure.

Put remote maintenance behind one gateway. Where contractors genuinely need access, route it through a single VPN or remote access gateway with multi-factor authentication, per-session approval and logging. CERT-FR accepts firewall rules that allow only the contractor's source addresses as an emergency measure, but says that is not a permanent fix. The contractor's convenience should never set your security level.

Change defaults and harden what stays. Replace vendor and installer passwords, create view-only accounts for anyone who does not need to change settings, update firmware, and on Danfoss units set the security level to Strict as the vendor and CERT-FR recommend. If a unit is end-of-life, plan its replacement now rather than waiting for the next alert.

Enforce limits below the controller. Red Tiger's advice applies well beyond supermarkets: temperature, pressure and dosing limits should be enforced in the programmable logic or by independent safety interlocks, not only in the operator screen an attacker can reach. Make sure staff can run equipment manually and know who to call when a setpoint changes with no shift action behind it.

Treat an unexplained change as an incident. A cabinet that is suddenly warm is a security event until proven otherwise. Add facilities telemetry to your monitoring where you can, write the scenario into your incident response plan, and rehearse it. CERT-FR's sequence for a compromised unit is a useful template: remove the internet exposure, reboot or factory reset, reconnect only through a protected network, reconfigure, then apply the vendor's hardening before the unit goes back into service.

How Cybergen Can Help

Cybergen's CREST penetration testing and continuous threat exposure management services find the controllers, cameras and remote access boxes that suppliers have left reachable from the internet, including the operational technology that normal scanning misses. Our third-party and supply chain risk management service helps you set and check the access rules your maintenance contractors work to, and our 24/7/365 managed detection and response and incident response teams are there when something in a store or depot starts behaving in a way nobody asked for.

Frequently Asked Questions