Blog Cybersecurity
French Supermarket Fridges Hacked: Lessons in IoT Security
On this page· 7 sections
Overnight from October 11 to 12, 2026, hackers took control of refrigeration systems in hundreds of French supermarkets and drove fridge and freezer temperatures up to 50°C. Fresh and frozen food had to be thrown away, and prosecutors reported fires. It is a sharp reminder that IoT security is not a side issue.
What happened in French supermarkets
The attack unfolded in a single night, from Sunday into Monday. According to France 24, which compiled statements from the retailers, some 150 to 200 Intermarché stores, almost 100 Coopérative U outlets, 80 Carrefour supermarkets, and around 30 Monoprix branches were affected. Carrefour added that the vast majority of its 6,000 stores were not hit. E.Leclerc was also affected and said one of its refrigeration equipment suppliers had been targeted.
The exact count is still moving. franceinfo wrote that the number of stores attacked could not yet be established, while AFP reporting quoted by CBS News put the figure at at least 300 Intermarché and Netto stores. Gaps like these are normal in the first days of a large incident.
The Paris prosecutor’s office opened an investigation into a large-scale attack on connected refrigerators across several major food retailers. The aim is to identify the victims and link the attack to the reported food losses and fires. According to a source close to Prime Minister Sébastien Lecornu, quoted by CBS News, France’s national cybersecurity agency found a vulnerability in software made by a Danish company, contacted the vendor, and is coordinating with European counterparts because other countries may also be affected.
Who is behind it? At the time of writing, no official body has named anyone. A French security expert quoted by MacGeneration warned that blaming a particular country without evidence would be premature. We take the same view.
The damage goes beyond spoiled food
The most visible loss is stock. Intermarché said its affected stores had to discard all fresh and frozen products to rule out any health risk. One store in Issy-les-Moulineaux estimated its loss at around 55,000 euros, according to franceinfo, while two stores in Haguenau reportedly lost 270,000 euros, according to MacGeneration.
Other costs show up later. Intermarché warned that some insurance policies may not cover this kind of incident. Stores have to empty shelves, clean up, and make sure their systems are safe before selling again. One store director in Issy-les-Moulineaux went as far as cutting the digital connection to his refrigeration units to prevent a repeat attack. In other words, that store went back to running things by hand for now.
How a fridge gets hacked
A modern supermarket fridge does not work in isolation. Each display case is regulated by a controller connected to the network, so technicians can monitor and adjust settings remotely. That convenience for maintenance becomes an entry point once the equipment stops being maintained.
Several outlets report that the targeted systems used controllers from Danfoss, a Danish manufacturer that runs refrigeration for many retail chains. In a statement quoted by CBS News, Danfoss said most of the affected equipment consisted of legacy products, such as the AK-SM800 and AK-SC355 series, which no longer receive software or security updates. Danfoss added that it had long advised supermarkets to update those models. MacGeneration notes that the manufacturer has considered the AK-SM800 obsolete since 2021.
According to BFM TV reporting summarized by MacGeneration, the attackers triggered continuous defrost mode with a 50°C setpoint. Compare that with a freezer that should sit at around −18°C, as one employee told franceinfo. How the attackers got in is still under investigation, so we will not guess which weakness was used.
The real lesson is not about one brand. Almost every vendor has products that eventually reach end of life. The trouble starts when such devices stay connected to the network for years while nobody notices that their security updates have stopped.
Similar devices are all around you
It is tempting to see this as a European supermarket problem. Yet the same pattern exists in many organizations in Indonesia and elsewhere. Clinics and pharmacies keep vaccines and medicines in monitored cold storage. Campuses and office buildings run air conditioning and lighting through building management systems. Schools install CCTV and door access that can be opened from an app. Convenience stores and food businesses rely on freezers that increasingly come with sensors.
All of this falls under the Internet of Things (IoT), or operational technology (OT) in industrial settings: devices that control the physical world and sit on a network. Unlike laptops, they are rarely updated, rarely audited, and often installed by third parties whose contracts ended long ago. Factory default passwords sometimes never change, and remote access opened once for a technician is simply left open.
We have not found reports of a similar attack on refrigeration systems in Indonesia. But the French case shows that attackers only need outdated equipment that can be reached from outside. That condition knows no borders, much like the PoeLLM botnet that targeted exposed, unpatched AI servers.
What this means for your organization
The good news is that prevention is not complicated. The hard part is usually getting started, because these devices rarely appear on the IT team’s list of responsibilities. Four steps can be tackled gradually.
List every connected device. Record the location, vendor, model number, firmware version, and who holds access, including maintenance contractors. You cannot protect equipment you do not know exists.
Check vendor support status. Ask whether each device still receives security updates. For anything at end of life, plan a replacement and budget for it. In the meantime, treat that device as your weakest point.
Close internet paths and separate the network. Control panels should not be reachable directly from the internet. Remote access belongs behind a VPN or a dedicated channel, default passwords should be changed, and IoT devices should live on their own network segment, away from office systems and sensitive data.
Set alarms and keep a manual fallback. Configure alerts for unusual changes in temperature or settings, especially at night and on weekends. Make sure staff know how to take over manually and whom to call when an alarm goes off.
For organizations with many sites, such as an education office overseeing dozens of schools or a network of clinics, this work is most effective when done centrally. Our cybersecurity and Internet of Things teams regularly help map devices and restructure networks without disrupting daily operations. We have also written about why the gap between a flaw being disclosed and exploited keeps shrinking in AI-powered cyberattacks.
Frequently asked questions
Could the smart fridge or air conditioning in my office be hacked the same way?
Yes, if the device is on the network, reachable from the internet, and no longer updated. The risk drops sharply once remote access is closed, default passwords are changed, and the device sits on a separate network.
How do I know whether a device has reached end of life?
Check the vendor’s official website or ask the distributor directly, quoting the model number and firmware version. Vendors usually publish lists of products that are no longer supported, along with suggested replacements.
Who carried out the attack in France?
That is not yet known. The Paris prosecutor’s office is still investigating, and local security experts have cautioned against blaming anyone without evidence. What is clear is the target: network-connected refrigeration systems, most of them running legacy equipment.
Closing thoughts
The French fridge case shows that a cyberattack does not always end with leaked data. Sometimes it ends with empty shelves, wasted food, and fires in stores. Start with a simple question: which devices in your buildings are connected to the network, and who looks after them? If you would like a partner to help map them, feel free to get in touch.
Sources
- France 24, “‘Unprecedented’ cyberattack targets refrigeration units at hundreds of French supermarkets” (October 12, 2026)
- CBS News, “Hackers turn up the heat in refrigerators at hundreds of supermarkets in France” (October 12, 2026)
- franceinfo, “Des centaines de frigos mis hors service après une cyberattaque contre les supermarchés” (October 12, 2026)
- MacGeneration, “Des frigos réglés à 50 °C : une cyberattaque frappe des centaines de supermarchés français” (October 12, 2026)
