French Supermarket Cyberattack: What Happens When Hackers Take Control of Refrigeration Systems?
Staff arriving at supermarkets across France on Monday morning faced a problem few would have anticipated. Refrigerators and freezers had been remotely manipulated overnight, with some reportedly reaching temperatures of 50°C.
Fresh and frozen food had to be discarded, stores faced disruption, and reports emerged of fires and damaged equipment.
The cause was a cyberattack targeting the digital systems used to control commercial refrigeration.
By 15 October, French officials were reporting that around 700 supermarkets had been affected. The financial consequences were substantial, with Intermarché reporting losses running into tens of millions of euros.
Perhaps the most interesting aspect of this incident is the equipment involved.
Refrigeration systems aren't necessarily what people think of when discussing cybersecurity, yet they can be connected to networks, administered remotely and relied upon for essential business operations.
The incident offers an opportunity to examine an area of cybersecurity that can receive less attention than conventional IT systems.
What happened to the French supermarkets?
The attacks began overnight on 11–12 October 2026, affecting refrigeration equipment used by several French supermarket groups, including Intermarché, Carrefour, Monoprix and Coopérative U.
Attackers gained unauthorised control of refrigeration management systems and altered operational settings, reportedly forcing equipment into defrost cycles and causing temperatures to rise dramatically.
For supermarkets, maintaining the correct temperature is essential to food safety. Once chilled or frozen products have been exposed to unsuitable conditions, they may no longer be safe to sell.
The resulting losses were therefore immediate and tangible.
France's cybersecurity agency, ANSSI, issued an alert covering compromised remote refrigeration controllers, including equipment from Danfoss, Copeland and Dixell.
The investigation remains ongoing. As of 15 October, no perpetrators had been publicly identified, and the precise method used to compromise the systems had not been conclusively established.
That uncertainty matters because, although security weaknesses had previously been discovered in some affected product families, it would be premature to claim that investigators have confirmed a particular vulnerability was responsible.
Why are refrigeration systems connected to the internet?
Commercial refrigeration has become increasingly sophisticated.
Rather than relying exclusively on local controls, modern installations can use central management systems to monitor temperatures, manage defrost schedules, generate alerts and allow technicians to investigate faults remotely.
These capabilities provide genuine operational benefits.
A refrigeration engineer can assess a problem without necessarily travelling to a store.
Operators can monitor multiple installations, identify developing faults and respond to alarms more efficiently.
However, remote management also introduces another way for an attacker to reach the equipment.
If a management interface is accessible from the public internet, its security becomes particularly important. Vulnerabilities, weak credentials or insecure configurations may allow an unauthorised person to interact with systems that control physical processes.
This is part of a wider area known as operational technology (OT) – the hardware and software used to monitor or control equipment and physical operations.
OT is found in manufacturing, healthcare, utilities, transport and commercial buildings, as well as supermarkets.
A cybersecurity incident affecting these systems can have consequences beyond information loss. Equipment may stop working, processes can be interrupted and, depending on the environment, physical safety can be affected.
Were the vulnerabilities already known?
There is an important detail in the reporting surrounding this incident.
In August 2026, cybersecurity researchers at Claroty published findings concerning vulnerabilities in Danfoss AK-SM 800A refrigeration controllers.
Their research identified weaknesses affecting the devices' web management interfaces, including an authentication bypass and vulnerabilities that could allow an attacker to execute commands on a device.
The issues were disclosed to Danfoss, which released updated firmware to address them.
Following the supermarket attacks, Danfoss stated that many of the affected installations were either operating outdated firmware or using older equipment that no longer received security updates.
Reuters also reported that thousands of Danfoss management interfaces remained visible on the public internet. That figure describes exposed interfaces, rather than a confirmed number of vulnerable or compromised devices.
These findings raise understandable concerns about how such equipment is maintained and protected.
There is an important distinction, however, between knowing that a product has had vulnerabilities and establishing exactly how a particular incident occurred.
The wider lesson doesn't depend on proving that one specific vulnerability was exploited.
Unsupported equipment, internet-facing management interfaces and inadequate access restrictions can all increase the likelihood or impact of a cyberattack.
The problem of overlooked connected equipment
Most businesses have become accustomed to considering the cybersecurity of laptops, servers, email accounts and cloud services.
Other connected systems may receive less scrutiny, particularly where their installation and maintenance sit outside the IT department.
Consider the equipment commonly found in commercial premises.
Heating and ventilation systems may be managed by building contractors. Electronic access controls might be supported by a security installer. Refrigeration, alarms and other specialist equipment may be maintained by suppliers with their own remote access arrangements.
These systems can have long operational lifespans. Some may remain in service long after the software or hardware reaches the end of its supported life.
That creates a challenge for organisations trying to maintain an accurate understanding of their cybersecurity risks.
Who is responsible for updating the equipment? Who controls remote access? Does anyone review whether the supplier still needs access? And what happens when the manufacturer stops issuing security updates?
Those questions need clear answers even where the organisation has outsourced the technical maintenance.
A maintenance contract doesn't remove the business impact if the equipment becomes unavailable or unsafe to operate.
Five questions businesses and GP Practices should be asking
The French supermarket incident provides a useful opportunity for organisations to review their own connected equipment.
1. Do we know what equipment is connected?
Maintain an inventory of network-connected systems, including equipment managed by facilities teams and external suppliers. Record its purpose, ownership, support status and relevant network connections.
2. Can any of it be accessed directly from the internet?
Review remote management arrangements and avoid exposing administrative interfaces publicly. Where remote access is necessary, use appropriately secured connections, strong authentication and access restrictions.
3. Is the equipment still supported?
Establish whether manufacturers continue to provide security updates. Unsupported systems may require replacement or additional protective measures while they remain in service.
Updates to operational equipment should be assessed and coordinated with the relevant technical specialists to avoid disrupting essential processes.
4. Who can access it?
Review supplier and contractor access, including shared credentials, administrative privileges and accounts that may no longer be required.
Access should be limited to what is necessary and monitored appropriately.
5. What happens if the system fails or is compromised?
Consider the consequences of incorrect settings, unavailable equipment and loss of remote monitoring.
For systems where temperature, safety or operational continuity matters, independent alarms, suitable local safeguards and documented recovery procedures may help reduce the impact.
These questions are relevant to organisations of all sizes. A smaller business may have fewer connected systems, but the failure of just one critical installation could still interrupt its operations.
Cybersecurity needs to extend beyond traditional IT
The UK's National Cyber Security Centre (NCSC) has published guidance on securing connectivity in operational technology environments.
Its recommendations include reducing unnecessary exposure, controlling remote access, segmenting networks, monitoring connections and addressing the risks associated with obsolete equipment.
These principles are especially relevant where external contractors need to maintain equipment remotely.
Organisations should understand how those connections work and what protections are in place, rather than assuming that responsibility rests entirely with the supplier.
There is also a wider business continuity consideration.
Protecting an operational system against unauthorised access is important, but organisations should consider how they would detect a problem and continue operating safely if that protection failed.
The two activities need to work together.
What can we learn from this incident?
The investigation into the French supermarket attacks is still developing, and further information may emerge about the methods used and the organisations affected.
What is already clear is the scale of disruption that can follow the compromise of connected physical equipment.
For organisations reviewing their cybersecurity arrangements, this is a useful reminder to look beyond the systems traditionally managed by IT.
A comprehensive risk assessment should consider the technology that supports the organisation's day-to-day operations, including equipment installed or maintained by third parties.
That doesn't mean every connected device presents the same level of risk. The priority should reflect what the equipment does, how it can be accessed and what would happen if it were compromised.
For a supermarket, refrigeration is fundamental to its operation. For another business, the equivalent might be a building management system, a production controller or specialist equipment supporting essential services.
Understanding those dependencies is an important part of managing cybersecurity risk.
At Kafico, we help organisations understand their information security risks and develop practical approaches to managing them. If you're reviewing the security of connected systems or your arrangements with technology suppliers, get in touch to discuss how we can help.
Sources and further reading
Jeff Pullen, CISSP, CCSP
Information Security Consultant
Kafico
Comments