French Supermarket Fridge Hack: How Hackers Spoiled the Food

By Jaspal Singh October 13, 2026 Updated: October 13, 2026

Overnight on Sunday, 11 October 2026, attackers reached the refrigeration control systems of hundreds of French supermarkets and forced their display cases into continuous defrost, spoiling fresh and frozen food. The target was Danfoss supervisory controllers, mostly old or unpatched models, which shows how an exposed building controller can become a food-safety problem.

What Happened

On Monday, 12 October, staff at several French grocery chains found chilled and frozen cases out of service. Coopérative U said its refrigeration had been affected since the previous night, and its chief executive, Dominique Schelcher, called the attack unprecedented and unacceptable. According to figures the chains gave AFP, reported by RTÉ News, at least 300 Intermarché or Netto shops, more than 100 Coopérative U outlets and several E.Leclerc stores were hit. Carrefour Market and Monoprix were also named in French reports, but neither had confirmed it at the time of writing.

The trade publication Cooling Post said the exact count is not known, though reported incidents point to around 500 stores. Intermarché told its affected branches to throw away all fresh and frozen products in the failed units. E.Leclerc confirmed that the attack had hit one of its refrigeration equipment suppliers rather than its own IT systems.

The Paris prosecutor's office opened an investigation into what it called a large-scale cyberattack on the refrigerators of several major food retail chains. It said the probe will identify the victims and link the attack to the food losses and to the outbreak of fires that stores reported. A person close to Prime Minister Sébastien Lecornu said France's national cybersecurity agency had identified a vulnerability in software supplied by a Danish company, contacted the vendor, and was alerting European counterparts because other countries may also be exposed.

That Danish company is Danfoss, one of the largest makers of commercial refrigeration controls. Danfoss told AFP that most of the affected equipment was legacy hardware that no longer receives software or security updates. It named two supervisory controllers: the AK-SM800, which Cooling Post reports was declared end-of-life in 2021, and the AK-SC355, phased out in 2016. Some current AK-SM800A units were also hit, but those were running outdated firmware. Danfoss said it is working with affected customers on firmware updates where available, stronger network protections and the removal of direct internet exposure.

EU agriculture commissioner Christophe Hansen condemned the attack and warned that food security needs more attention at every level. No group had claimed responsibility by Tuesday morning.

Why It Matters

Most retail cyberattacks steal card data or lock up checkouts. This one did physical damage: it changed the behaviour of machines that keep food safe, and the losses arrived in hours: every chilled or frozen product that sat in a warming cabinet overnight had to be destroyed, whether or not it looked spoiled.

The attack also shows how long building and industrial equipment stays in service. A refrigeration controller is bought with the store fit-out and often runs for 10 to 20 years. The AK-SC355 left Danfoss's catalogue a decade ago, yet it was still running cold rooms in 2026. Nobody is prompted to update it, and it is maintained by refrigeration contractors, not IT security teams.

Exposure is the other half of the problem. Baptiste Robert, chief executive of the French security firm Predicta Lab, told BleepingComputer he found 2,752 Danfoss systems reachable from the internet on Monday, 1,590 of them in France. Each of those is a web management page that anyone can try to log into. When the equipment behind the page is unpatched, a single technique can be repeated across hundreds of stores in one night, which is roughly what the scale of this incident suggests.

For other countries the warning is direct. The vulnerable controller family is sold worldwide; the US Cybersecurity and Infrastructure Security Agency lists its deployment as global in the commercial facilities sector. Similar supervisory controllers run cold storage in warehouses and food distribution centres.

How It Works

A supermarket refrigeration system has layers. At the bottom, each display case or cold room has a small case controller that reads temperature sensors and opens and closes valves. Compressor racks, usually in a plant room, supply the refrigerant. At the top sits a system manager, such as the Danfoss AK-SM800 series: a supervisory computer that sets temperatures, schedules defrost cycles, logs readings for food-safety records and raises alarms. Its web interface lets contractors and head-office teams monitor many stores remotely.

Defrost is a normal, necessary function. As cold air passes over a case's evaporator coil, moisture in the air freezes onto it, and a thick layer of ice stops the coil from cooling. Several times a day the controller stops cooling and melts the ice, either with electric heating elements or by routing hot refrigerant gas through the coil. A sensor ends the cycle once the coil is clear, and cooling resumes within minutes.

According to Cooling Post and French broadcaster BFM TV, the attackers forced units into defrost and kept them there. Heaters or hot gas ran continuously, so cases that should hold chilled food at a few degrees above freezing, or frozen goods well below it, warmed steadily overnight. Because the command came from the supervisory layer, every case it controlled could be switched at once. Prosecutors also cited fires. Investigators have not yet explained how they started, but defrost heaters that run far longer than designed are an obvious line of inquiry.

How the attackers got in has not been confirmed. The public record shows what was possible. In May 2025 CISA published advisory ICSA-25-140-03 on the Danfoss AK-SM 8xxA series, based on research by Tomer Goldschmidt of Claroty Team82. An update in August 2025 brought it to three flaws:

CVE-2025-41450 (authentication bypass): the controller could generate a login password from the current date. Anyone who worked out the formula could compute the day's password and log in without knowing the configured one. It was fixed in release R4.2.
CVE-2025-41451 (command injection): text entered in the alarm-to-email settings was passed into an operating-system shell command without being cleaned, so a logged-in user could run arbitrary commands. It is rated 8.7 on the CVSS v4 scale and was fixed in version 4.3.1.
CVE-2025-41452 (denial of service): a logged-in user could alter the web server's configuration and crash the management application. This one was also fixed in 4.3.1.

Chained together, the first two flaws give a remote attacker full control of an internet-facing system manager: log in with a computed password, then run commands. At the time, CISA said it had no reports of public exploitation and rated attack complexity as high. Danfoss says the older AK-SM800 and AK-SC355 models will never receive fixes at all. Whether the attackers used these CVEs, stolen contractor credentials, or simply default and reused passwords on unsupported hardware is one of the questions investigators now have to answer.

The defence is standard practice for operational technology. Take management interfaces off the open internet, put controllers behind a firewall on their own network segment, require a VPN or a vendor remote-access gateway for contractors, and update firmware or replace hardware that no longer gets fixes.

What's Still Unknown

Who did it, and why. No group has claimed the attack. Despite French alerts about Russian hybrid operations, no authority has attributed it.

The entry point. Neither Danfoss nor France's cybersecurity agency has said which vulnerability was used, or whether access came through the stores' own internet-facing controllers or through a refrigeration service provider that manages many sites. Intermarché said a service provider managing its store refrigeration was affected, which points to the second, but the details are not public.

The true scale and cost. Store counts range from the 400-plus confirmed by three chains to Cooling Post's estimate of around 500. No company has published a total for destroyed stock, and the number and severity of the fires have not been disclosed.

Whether other countries were hit. BleepingComputer noted that Ahold Delhaize, which runs supermarkets in Belgium, the Netherlands and the US, took some systems offline on Monday after a separate cybersecurity incident, but there is no evidence linking the two.

Frequently Asked Questions

Which supermarkets were affected by the French fridge cyberattack?

The chains themselves confirmed at least 300 Intermarché or Netto stores, more than 100 Coopérative U outlets and several E.Leclerc stores, according to AFP. Carrefour Market and Monoprix were named in French media reports but had not confirmed they were hit. Trade publication Cooling Post estimates that about 500 stores were affected in total, though no official count has been published.

How did hackers make supermarket fridges warm up?

They reached the Danfoss system managers that supervise each store's refrigeration and forced display cases into continuous defrost. Defrost normally runs for a few minutes to melt ice off the cooling coil using heaters or hot gas. Left running all night, it steadily warmed chilled and frozen cases until the food inside was no longer safe to sell.

Was food in the affected stores safe to eat?

The retailers treated it as unsafe. Intermarché told affected branches to throw away all fresh and frozen products from the failed units, and other chains reported large-scale stock destruction. Food that rises above its safe holding temperature for hours cannot be reliably checked by eye or smell, so discarding it is the standard precaution rather than a sign of confirmed contamination.

Which Danfoss controllers were involved?

Danfoss named the AK-SM800 system manager, which reached end-of-life in 2021, and the older AK-SC355, phased out in 2016. Neither receives software or security updates any more. Some current AK-SM800A units were also affected because they were running outdated firmware. Danfoss says it has long advised customers to update supported systems and migrate legacy ones.

Were known vulnerabilities used in the attack?

That has not been confirmed. CISA advisory ICSA-25-140-03 describes three AK-SM 8xxA flaws found by Claroty Team82, including a date-based password bypass and a command injection, fixed in firmware R4.2 and 4.3.1. France's cybersecurity agency says it found a vulnerability in the vendor's software, but it has not said whether it is one of these or something new.

Who is behind the supermarket refrigeration attack?

Nobody has claimed responsibility, and French authorities have not attributed it. The Paris prosecutor's office has opened an investigation to identify victims and link the attack to the food losses and fires that stores reported. Speculation about state-linked hybrid attacks exists because of recent French warnings, but there is no public evidence pointing to any group.

Could the same attack happen in other countries?

Yes, in principle. Danfoss system managers are installed worldwide, and a security researcher counted 2,752 of them reachable on the internet on 12 October, about 1,160 of them outside France. France's cybersecurity agency is alerting European counterparts. Any operator running unsupported or unpatched controllers with an internet-facing web page carries the same basic risk.

What should businesses with connected refrigeration do now?

Check whether any controller's management page can be reached from the internet and remove that exposure first. Then put controllers on a separate, firewalled network, require a VPN or a vendor gateway for remote service access, change default and shared passwords, install current firmware such as AK-SM800A 4.3.1 or later, and plan to replace models that no longer get security fixes.