Hackers Heated French Supermarket Fridges to 50 °C

On the night of October 12, 2026, the French retail sector faced an unprecedented incident: hackers remotely compromised industrial refrigeration systems across hundreds of supermarkets. Instead of keeping products cold, the equipment began heating them, leading to massive stock destruction and, according to some preliminary reports, localized fires in store backrooms.

The Paris prosecutor's office has already opened an investigation, and the National Agency for the Security of Information Systems of France (ANSSI) has been mobilized to analyze the incident.

How the refrigerators were hacked

The target of the attack was equipment from the Danish company Danfoss, which manages temperature controls in retail spaces. According to technical data, the hackers did not encrypt data or demand a ransom. Their goal was pure physical sabotage.

The attack mechanism unfolded as follows:

• Attackers gained unauthorized access to management controllers (older models like the AK-SM800, or newer devices with unpatched firmware, were in the primary risk zone).
• They forcibly activated the automatic defrost mode for several hours.
• The temperature setpoint was changed to extreme values - in some cases reaching +50 °C.

This caused freezers and refrigerated display cases to operate like heaters. In some stores, the incident lasted for about six hours before staff noticed the anomaly or manually shut down the systems.

Scale of damage and affected networks

The number of affected locations is in the hundreds. Preliminary data indicates the attack impacted:

• Intermarché: about 150 - 200 stores.
• Coopérative U (Super U): about 100 retail outlets.
• Carrefour: confirmed impact on 80 supermarkets.
• Reports of malfunctions also came from E.Leclerc, Monoprix, and Netto.

Financial losses are estimated in the millions of euros. Just in two stores in the Alsace region, the damage amounted to about 270,000 euros due to the disposal of meat, frozen goods, and equipment damage. Companies warn that standard insurance policies might not cover losses from this type of cyber-sabotage.

Manufacturer position and government response

Danfoss confirmed the incident, noting that most compromised systems had not received security updates for a long time. The manufacturer strongly recommends that clients isolate controllers from direct internet access and update firmware immediately.

The French government views the incident as an attack on critical infrastructure. The Prime Minister has tasked ANSSI with checking if other food industry facilities in the country are under threat and is coordinating actions with European partners.

The myth of the "Russian link"

Against the backdrop of the incident, some media outlets suggested the involvement of Russian hackers. However, at this moment, there is no evidence linking this attack to Russia.

Furthermore, historical context suggests the opposite. Danfoss's own 2025 technical bulletins described similar attacks, but those were directed against supermarkets in Russia and Israel in 2022 (with the group Anonymous claiming responsibility at the time). The similarity in sabotage methods points to a known vulnerability in the equipment, rather than the signature of a specific state.

Today, the investigation is considering all versions, but the attribution of the attack remains unknown. The main task right now is not to find the culprits, but to urgently protect the remaining vulnerable systems across Europe.