On the night between Sunday 11 and Monday 12 October 2026 a cyber attack took control of the refrigeration systems of hundreds of French supermarkets. Display fridges and freezers were driven to high temperatures: according to Intermarché, up to 50 °C for six hours. In the morning store managers found food that had to be thrown away and, in some places, small fires.

The figures the chains gave the BBC show the scale. Coopérative U reports more than 100 stores hit, Intermarché and Netto 180, with another 100 disconnected from the internet as a precaution. Carrefour counts 80 out of 6,000 and Monoprix about 5% of its more than 400. E.Leclerc was hit as well. In total about 400 stores out of some 15,000. Two supermarkets in Alsace reported losses of €270,000. The Paris prosecutor’s office has opened a cyber-crime investigation.

The controllers of the cold chain

The target was the units that coordinate a store’s refrigerated cabinets and let technicians manage them remotely through a web interface: temperature thresholds, defrost cycles, alarms. At night freezers go through a short defrost in which the temperature rises slightly. The attackers ordered the units to heat up and stay hot.

On 12 October CERT-FR, the incident response centre of the French cybersecurity agency, issued an alert on Danfoss AK-SM and AK-SC series controllers. On the 13th it extended it to Copeland and Dixell xweb supervisors. The first recommendations are to update the firmware, set the strictest security level and change default passwords. Danfoss said the affected units were older models whose security software could not be updated.

A documented risk

In May 2025 the US agency CISA published an advisory on Danfoss AK-SM 8xxA controllers. A password generated from the date made it possible to bypass authentication (CVE-2025-41450). In August the advisory was updated with two more vulnerabilities, one leading to remote code execution and one to denial of service (CVE-2025-41451 and CVE-2025-41452). Danfoss fixed them in firmware releases R4.2 and R4.3.1.

On 9 August 2026 researchers from Team82, Claroty’s research group, published a full analysis of the firmware. Using the Censys search engine they had counted 2,765 AK-SM 800A controllers directly reachable from the internet. No official source has yet said which vulnerability was exploited in France.

What I think

I believe this is only the beginning, and I expect many more cases. We are connecting physical systems to the network at great speed: refrigeration, air conditioning, lifts, pumps, meters, medical devices. Every connection makes maintenance easier and widens the attack surface. Many of these devices stay in service for years after the vendor’s support ends, like the Danfoss models that could no longer be updated.

Here the damage was concrete and measurable: food thrown away, empty shelves, losses the press estimates in the millions. European Commissioner Christophe Hansen described it as a food security problem. The same pattern applied to a hospital, a water network or the cold chain for medicines would have far more serious consequences. That is why the issue risks being devastating. Meanwhile the cost of an attack is falling: as I wrote in Intelligence is eating software, the tools that lower the cost of writing software also lower the cost of attacking it.

The countermeasures have been known for a long time. No management interface exposed directly on the internet, technician access only through a VPN, default passwords changed, firmware up to date, an inventory of connected devices and the replacement of those no longer supported. The European Cyber Resilience Act points the same way. Since 11 September 2026 manufacturers must report actively exploited vulnerabilities in their products within 24 hours, including products sold earlier. From 11 December 2027 new products with digital elements must receive security updates for their whole support period. Devices already installed, however, will stay on the network for years. The inventory and architecture work is best done before the next case.

Cover image: the frozen food aisle of a Dia supermarket in Strasbourg. Photo by Pierre Rudloff on Wikimedia Commons — public domain — https://commons.wikimedia.org/wiki/File:Dia_int%C3%A9rieur.JPG