Key points
- In October 2026 attackers reached internet-connected refrigeration controllers in hundreds of French supermarkets, switched cabinets into defrost and pushed temperatures as high as 50°C. Several fires broke out.
- No deaths, injuries or food poisoning cases have been reported. The threat to life is indirect: fire, and spoiled food or medicines reaching people if a temperature breach is not noticed.
- The affected Danfoss controllers were old or end-of-life models left reachable from the internet. France’s CERT-FR told operators to disconnect them or restrict access.
What this article covers: what happened in the French supermarket refrigeration attack, why tampering with the cold chain is a public-health and fire-safety risk, and what retailers and cold-chain operators should change.
What it adds to the series: the cold chain is the part of critical infrastructure most people use every day without thinking of it as safety equipment. This attack shows that ordinary commercial controllers can be turned against the people they protect.
Most people think of a supermarket fridge as a convenience. In food-safety terms it is a control: it keeps meat, dairy, fish and ready meals below the temperatures at which bacteria multiply. In October 2026, attackers showed that this control can be switched off remotely, in hundreds of shops at once.
What happened in French supermarkets
Over the weekend of 11 and 12 October 2026, attackers logged into refrigeration management controllers made by the Danish company Danfoss and used in French supermarkets. The devices were mainly AK-SM 800 controllers, which reached end of life in May 2021, and older AK-SC 355 units phased out in 2016. Some newer AK-SM 800A units running outdated firmware were also hit (The Hacker News).
The attackers put refrigerated cabinets into defrost mode and drove temperatures up, in some cases to around 50°C. The Paris prosecutor’s office confirmed that fires broke out in some stores (CBS News).
Reported numbers vary by source and are still being established. AFP reported more than 300 Intermarché and Netto stores affected, while Reuters put the figure for that group at about 150. Carrefour reported about 80 stores, Coopérative U more than 80, and Monoprix about 30. Al Jazeera put the total at more than 500 shops (Al Jazeera). Retailers threw away chilled and frozen stock, and losses are estimated in the tens of millions of euros. Coopérative U’s chief executive Dominique Schelcher called the attack “unprecedented” (CBS News).
The Paris prosecutor opened a cybercrime investigation, handled by France’s anti-cybercrime office (OFAC). As of 22 October 2026, no group has been publicly identified as responsible.
How the attackers got in
The controllers have web-based management interfaces. Many had been left reachable from the internet, so store engineers and service contractors could check them remotely. Old devices that no longer receive security updates and are exposed online are an easy target. A source close to Prime Minister Sébastien Lecornu said France’s cyber agency ANSSI had found a vulnerability in the Danish manufacturer’s software (Al Jazeera).
On 12 October, CERT-FR, part of ANSSI, issued an alert telling operators to disconnect these controllers from the internet or filter access to them, and published a six-step remediation guide (RefIndustry).
Why a fridge attack is a threat to human life
Nobody has been reported harmed in this incident. That is largely because the attack was loud: cabinets at 50°C, alarms and visible defrosting are hard to miss, and stores discarded the stock. The losses are the safety system working. The risk to life lies in what the same access makes possible.
Fire
Forcing refrigeration equipment into abnormal states, such as continuous defrost heating, stresses heaters and compressors. Fires were confirmed in this attack. A supermarket fire during opening hours puts customers and staff at risk.
Foodborne illness
Chilled foods held above safe temperatures let bacteria such as Listeria, Salmonella and E. coli grow. The World Health Organization estimates that unsafe food makes about 600 million people ill and kills about 420,000 every year (WHO). Listeria is especially dangerous for pregnant women, older people and people with weak immune systems. A temperature breach that goes unnoticed, and food that is then sold, is how a cyberattack turns into a public-health incident.
Silent manipulation
The more dangerous version of this attack would be quiet. An attacker who raised temperatures by a few degrees while the controller kept showing normal readings could leave food in the danger zone for days. This is the pattern seen in industrial attacks such as TRITON and Stuxnet, where attackers hid what the equipment was really doing from the people watching it. In retail, many stores rely on the same controller both to run the cabinets and to record their temperatures.
Medicines and vaccines
The same kind of remotely managed cold storage is used by pharmacies, hospitals, blood banks and vaccine distributors, where products often must stay between 2°C and 8°C. This incident did not involve them. But a medicine that has quietly lost potency may look normal and still fail the patient who takes it, which makes cold-chain integrity a life-safety question beyond food.
What retailers and cold-chain operators should change
- Take controllers off the internet. Use a VPN with multi-factor authentication for remote access, and never expose management interfaces directly.
- Replace end-of-life equipment. Devices that no longer receive security updates should be retired or isolated.
- Monitor temperature independently. Use separate data loggers or sensors that the refrigeration controller cannot change, so a hacked controller cannot hide a breach.
- Keep manual checks. Routine manual temperature checks catch problems that automated systems miss or misreport.
- Plan for an incident. Stores need a procedure for a cold-chain breach: what to discard, who to notify and how to switch to manual control.
- Treat it as critical infrastructure. The EU’s NIS2 Directive already lists food production, processing and distribution among its “other critical” sectors (NIS2 Directive). Refrigeration controllers belong in those risk assessments.
Where this fits in the series
The French attack sits alongside other cases in this series where digital control of physical systems creates a risk to life: industrial control systems, water supply, hospitals and smart cities. For the defensive measures common to all of them, see protecting critical infrastructure.
Frequently asked questions
Did anyone die or fall ill because of the French supermarket fridge attack?
No. As of 22 October 2026, no deaths, injuries or food poisoning cases have been reported. Fires broke out in some stores, and retailers discarded affected stock.
How could hacking a supermarket fridge kill someone?
Indirectly. Forcing equipment into abnormal states can start fires, and food kept above safe temperatures can grow bacteria such as Listeria or Salmonella. If a temperature breach is hidden or unnoticed and the food is sold, people can become seriously ill.
Who was behind the attack on French supermarkets?
No group has been publicly identified. The Paris prosecutor opened a cybercrime investigation handled by France’s anti-cybercrime office (OFAC).
Which equipment was targeted?
Mainly Danfoss AK-SM 800 and older AK-SC 355 refrigeration controllers, including end-of-life units left reachable from the internet. CERT-FR advised operators to disconnect them or restrict access.
Last reviewed: 22 October 2026.
