Cyberattack Heats Fridges at Hundreds of French Supermarkets
Hackers remotely pushed refrigeration units at hundreds of French supermarkets to dangerous temperatures overnight into 12 October 2026. According to French officials, about 700 of the country's 10,000 supermarkets were affected. Danfoss said most of the affected units were older controllers that no longer receive security updates. The Paris prosecutor has opened an investigation. For any business that runs automated systems, the lesson is practical: list every device that connects to your network, check whether its vendor still supports it, and cut off any remote access you do not need.
In short
- About 700 of France's 10,000 supermarkets were affected, according to French officials, with fridges pushed to as high as 50 degrees Celsius.
- Danfoss said most affected units were older controllers that no longer receive security updates.
- Remote management features create entry points, so every connected device needs an owner and a support date.
- Cutting unneeded internet access and securing remote logins are the first practical steps.
- Automated monitoring can raise alarms, but only replacing unsupported hardware fixes the underlying weakness.
What happened
Overnight from 11 to 12 October 2026, hackers reached refrigeration controllers in French stores and raised fridges and freezers to as high as 50 degrees Celsius. According to Al Jazeera, the heat spoiled food and caused fires at several stores. The Paris prosecutor's office said its cybercrime unit is investigating the scale of the damage, including the spoiled stock and the fires. French Finance Minister Roland Lescure told Parliament on 13 October 2026 that about 700 of the country's 10,000 supermarkets were affected, according to the Associated Press. Retailers gave their own figures. Cooperative U said 80 of its 2,000 stores were hit, and Les Mousquetaires said 300 of its Intermarché and Netto stores were affected. These counts come from different sources and have not been combined into one official total.
The same week, Dutch-Belgian grocer Ahold Delhaize said on 12 October 2026 that it had taken some systems offline to contain a security issue. Its stores stayed open, but websites for several brands, including Stop & Shop, Food Lion and Albert Heijn, were still down on Tuesday, according to the Associated Press. The company said it had no evidence that customer or employee data had been stolen. Neither Ahold Delhaize nor the French authorities have linked the two incidents in the statements reviewed for this article.
Which equipment was hit
Danish manufacturer Danfoss told AFP that most of the affected units were older products that no longer get software or security updates. The French national cybersecurity agency, ANSSI, had identified a vulnerability in Danfoss software. The table below summarises the controllers named in the reporting.
| Controller | Status according to Danfoss | Advice from CERT-FR and Danfoss |
|---|---|---|
| AK-SM 800 | End of life since May 2021, no security updates | Disconnect or filter access, and replace |
| AK-SC 355 | Phased out in 2016, no security updates | Disconnect or filter access, and replace |
| AK-SM 800A | Current model, some units ran outdated firmware | Disconnect or filter access, and keep firmware current |
Danfoss has not published how many systems were compromised. Reuters, citing an analysis by the security firm Sekoia, reported affected units in France, Spain, Portugal, Poland, Germany and Belgium.
Why it matters for businesses that automate work
The weakness was remote control. These controllers can be managed over a network, and an attacker who gets in can send commands such as a forced defrost. Any automated system works the same way. Sensors, dashboards and remote alerts each create a path into the network, and each path needs an owner. Claroty, a security firm, had published an August 2026 report on login flaws in the AK-SM 800A. Danfoss said its firmware updates included fixes for those flaws, which means the risk sat mainly in units that had not been updated.
What changes in practice
Start with an inventory. Write down every device, controller and cloud tool that touches your systems, with the vendor's end-of-support date beside each one. Anything past that date needs a replacement plan, even if it still works. A practical sequence for most operators looks like this:
- Check whether any equipment can be reached from the internet. CISA's Internet Exposure Reduction Guidance, published in 2026, urges operators to route remote access through a managed gateway or VPN rather than connecting directly to controllers.
- Require unique passwords and phishing-resistant multi-factor authentication for every remote login.
- Keep offline backups and a manual way to run critical processes. CISA and the FBI recommended this in a September 2026 fact sheet on third-party control system integrators.
- Set temperature alerts that reach a named person, so a drifting unit is noticed within hours rather than at the next walk-through.
Automation has a limit here. Monitoring can detect a fault and log it, but it cannot patch hardware that its vendor no longer supports. Where a controller is out of support, replacement is the only real fix, and that is a budget decision for the owner.
What to watch next
- Whether the Paris prosecutor names suspects or narrows the scale of losses. Thierry Cotillard, who heads Les Mousquetaires, told BFMTV that he expected losses of tens of millions of euros across France, according to Reuters.
- Whether Danfoss publishes a security advisory. As of 13 October 2026, its advisories page listed none about the attack.
- Whether Ahold Delhaize restores its systems. The company said its teams were working to restore affected systems safely.
- Whether regulators in other European countries report similar incidents as ANSSI coordinates with its counterparts.
How AiStaffo would automate this
AiStaffo would start by building one inventory of connected equipment and software, with each vendor's support end date recorded beside it. Temperature readings, controller status and access logs would then feed into a single automated report, with alerts sent to a named person when a unit drifts or a device is flagged as out of support. Routine checks, such as confirming that remote access is still restricted and that backups ran, would run on a schedule without staff having to remember them. The owner still decides which equipment to replace, approves the budget, and signs off on who can reach what. Book a free automation audit.
Questions people ask
Which French supermarkets were affected by the refrigeration cyberattack?
How can a business tell if its refrigeration controllers are at risk?
Did the attack involve customer data theft?
What should a business do first after a warning like this?
Can automation prevent this kind of attack?
Are the Ahold Delhaize outage and the French attack connected?
Book a free automation audit
Thirty minutes. We look at one process you run every week and tell you exactly what an AI worker would take off your desk, and what it would not.
