In three weeks the attack on French supermarket fridges has become an international case. On Monday 2 November 2026 stores in at least six European countries, among them Sweden, Belgium, Luxembourg, Ireland, Italy and Estonia, found display fridges and freezers controlled remotely and stock to be thrown away. In Belgium and Luxembourg some Delhaize stores were hit, in Ireland 13 of the 223 SuperValu stores. In Sweden one supermarket found its fridges and freezers set to 50 °C.

On 29 October Reuters reported that the Pentagon is treating the late-August freezer failures at no fewer than six commissaries on US military bases as a suspected cyber attack. At Fort Huachuca, Arizona, the freezer had gone into defrost mode and heated up all the food, as happened in France. Military investigators are in contact with their French counterparts. In Italy, according to ANSA, cybersecurity and intelligence officials had a meeting scheduled for Tuesday 3 November. European Commission spokesperson Thomas Regnier said the incidents are not isolated. Along with the alarm came the question of whether AI was behind it.

How they got in

On 21 October Vincent Strubel, director general of ANSSI, the French cybersecurity agency, told the Senate foreign affairs committee that elementary security flaws had been exploited. The refrigeration equipment was exposed directly on the internet and administered without particular protection, with weak passwords. Strubel recalled that since 2014 ANSSI has published a guide on securing industrial systems whose first recommendation is not to expose them directly to the network. He added that those recommendations are not systematically followed. Richard Horne, head of the UK National Cyber Security Centre, said the French fridges were connected directly to the internet with default passwords.

Danfoss stated that most of the affected units were end-of-life AK-SM800 and AK-SC355 models that no longer receive security updates. The CERT-FR alert, updated several times since 12 October, also covers Copeland and Dixell supervisors. According to the ethical hacker Clément Domingo, interviewed by RMC on 13 October, the Danfoss devices could be accessed with a very simple password, each time the date of the day. ANSSI has not confirmed this detail and attributes the access to direct exposure and weak passwords rather than to the vulnerabilities published by researchers over the past two years.

The AI hypothesis has not been borne out either. Paul Chichester, director of operations at the UK centre, said this was not an AI attack. Nicole Carignan of Darktrace explained that nobody used unknown vulnerabilities: the attackers got in through internet-facing controllers with end-of-life firmware and default passwords. There is no public technical analysis of the second wave yet.

What I think

As the agencies that analysed it describe it, the attack was within reach of anyone who knew how to look for exposed devices and try weak or default passwords. It needed no unknown vulnerabilities and no new tools. The scale of the damage comes from the number of stores that had left the same door open. On 13 October I wrote that I expected more cases. Three weeks later the second wave arrived. The case also shows that, with systems left in this state, the cost of an attack was already very low without any help from AI.

The risk of the alarm is that it moves attention to sophisticated threats and leaves in the background the measures that would have stopped this very attack.

What to do

These are the usual good cybersecurity practices, and they apply to any networked equipment, from display fridges to air conditioning.

  1. No direct access from the internet. Management interfaces must not be reachable from the public network. Technicians connect remotely through a VPN.
  2. Own credentials. Default passwords are changed at installation, with different credentials for each device and two-factor authentication where available.
  3. Updates. Firmware is kept up to date. Devices the vendor no longer supports are replaced.
  4. Inventory. Know what is connected and check periodically that your own addresses do not show up in scanning engines such as Shodan and Censys.
  5. Separate networks. The equipment sits on a network distinct from the one for tills and offices.
  6. Independent alarms. Temperature alarms do not depend on the controller and go off even if the controller is compromised.

Strubel reminded the Senate that equipment of the same kind also stores vaccines. The same rules apply in hospitals, pharmacies and laboratories. These are ordinary, inexpensive measures. They remain the foundation of defence against more sophisticated attacks too.

Cover image: the label of a Netgear WNR2000v5 Wi-Fi router with its default user name and password, cropped. Photo by ArnoldReinhold on Wikimedia Commons — CC BY-SA 4.0 — https://commons.wikimedia.org/wiki/File:Default_password.agr.jpg