Hackers seized Danfoss refrigeration controllers in hundreds of French stores overnight, forcing defrost cycles that spoiled food, sparked fires and cost tens of millions.
Published 13 October 2026 · 06:00 GMT
Monday morning in a Paris Intermarché, staff wheeled cartfuls of defrosted frozen food into a giant trash container set out on the street, molten ice cream sloshing from broken tubs. The fridges had not failed. Hackers had turned them into ovens, remotely, in the night of October 11.
The scene repeated itself across France on Monday, October 12, 2026. Store teams arriving for the morning shift found refrigerated display cases pouring out warm air. Meat, dairy, vegetables and frozen goods sat ruined after hours at temperatures as high as 50 degrees Celsius. Roughly 500 stores out of France's 15,000 were affected, according to BBC News estimates, and the cause was not a power failure or a broken compressor. It was a cyberattack — one that struck the country's food chain at its coldest point.
The attackers went straight for the equipment that keeps food safe. They did not touch checkout systems or customer data. They took over the control panels that manage a store's entire refrigeration fleet and ran the defrost heaters for hours instead of minutes. At some stores the overheated machinery sparked fires. Paris prosecutors confirmed a large-scale attack on connected refrigerators across several major retailers and opened an investigation.
Hackers didn't steal data. They stole dinner.
The intrusion landed overnight from Sunday into Monday. Store directors received automated alerts flagging unusual temperature rises and defrost programs starting at the wrong hour, according to French retail press. When morning teams arrived, the damage was done: entire cold aisles had spent the night heating instead of cooling. Intermarché told AFP its affected branches would have to throw away every fresh and frozen product. Procedures were grim and methodical — empty the refrigerated bins, have a bailiff record the losses, destroy the goods.
Intermarché and its Netto brand were hit hardest, with at least 300 shops targeted. Coopérative U counted nearly 100 outlets, including Super U and Hyper U stores. Carrefour reported 80 of its stores affected, and Monoprix said about 5 percent of its roughly 490 stores were hit. E. Leclerc confirmed that an attack on one of its refrigeration equipment suppliers had disrupted systems in several of its stores. Specialized retail outlets also carried unconfirmed reports naming Picard and Metro, though those companies had not confirmed anything by Monday evening. The dividing line was not the brand on the door but the control software inside: stores running the same connected refrigeration platform fell, others were spared.
The money piled up fast. Two supermarkets in Haguenau, in Alsace, reported a combined loss of 270,000 euros. Thierry Cotillard, the chief executive of Intermarché, told BFM TV the nationwide bill would reach tens of millions of euros in a single day. Each affected store must restock its fresh and frozen aisles from scratch, absorb the destroyed inventory, and carry the cost of emergency repairs on its refrigeration plant.
A supermarket's cold chain is run by linked control panels that manage temperatures and defrost cycles for every fridge and freezer in the building. Defrost is a routine function: for short periods, usually overnight, heaters melt the frost off the cooling coils. The panels can be reached over the internet so maintenance companies can adjust settings from anywhere. That convenience became the entry point. The attackers seized the defrost function and ran it continuously, at up to 50 degrees Celsius, for hours.
The weak point was known. In August 2026, researchers at Claroty's Team82 published findings on the Danfoss AK-SM 800A controller — the system manager that orchestrates a store's refrigeration equipment. They disclosed three vulnerabilities, including an authentication bypass using a hidden password derived from the current date and a command-injection flaw allowing remote code execution. They also found thousands of such management interfaces exposed to the public internet. There is no confirmed link between that research and this week's attack, but the shape of the failure matches: a known flaw, internet-facing equipment, and a physical consequence.
Danfoss, the Danish manufacturer, said it was aware of incidents in France affecting a limited number of refrigeration management systems. It identified the affected units as legacy controllers — the AK-SM800 and AK-SC355 lines — running outdated firmware that no longer receives software or security updates. The company said it had long advised customers to keep supported systems updated with the latest firmware and to migrate legacy equipment to current-generation models. Denmark's industrial champion now faces hard questions: France's retail federation, the FCD, has demanded full transparency from the supplier. Security specialists note that patching refrigeration plants is slow and expensive work — it means downtime, on-site intervention and expert validation — which is why so many stores kept running vulnerable kit.
Nobody knows yet, and nobody has claimed responsibility. The Paris prosecutor's office confirmed the scale of the intrusion but named no suspects. Prime Minister Sébastien Lecornu ordered France's cybersecurity agency, ANSSI, to investigate and to coordinate with European counterparts, since authorities believe other countries could be hit too. That caution is already justified: a Sekoia threat-intelligence analyst told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected, and vulnerabilities were reported in supermarkets in Belgium, Denmark, Luxembourg and the Netherlands.
What is clear is the choice of target. Hitting food is different from stealing data or locking computers for ransom. Dominique Schelcher, chief executive of Coopérative U, wrote on X: "Attacking equipment essential to the preservation of fresh products and to the food supply of the French people is extremely serious and is unprecedented. It is unacceptable." Christophe Hansen, the EU's agriculture and food commissioner, said food security requires more attention at all levels. The attack treated the food supply as infrastructure — and proved it behaves like one when it breaks.
The bill lands first on the store operators, many of them independent franchisees. Destroyed stock, emergency refrigeration repairs, restocking at short notice, lost trading days — the costs are immediate and concrete. Insurance may cover part of it, but policies written for break-ins and fires were not designed for a hacker turning a freezer into an oven from another continent. Christel Delberghe, director general of the European retail association Eurocommerce, said retail and wholesale play an essential role in keeping Europe supplied with the goods people rely on every day, adding that the incident underlines the importance of resilience across the entire supply chain. Resilience, here, is a polite word for spending money before the disaster.
France has seen this film before, in other sectors. ANSSI counted 128 ransomware attacks in the country in 2025, slightly fewer than the 141 recorded in 2024 — small businesses were the main victims, but hospitals and schools saw the sharpest rise. In October 2025, the CHI Haute-Comté hospital network was hit, knocking out more than a thousand workstations across Pontarlier and seven associated sites, with full recovery not expected before early 2027. And this is not only a French story: about a dozen US military commissaries suffered similar refrigerator disruptions in late August, with food losses after their cold systems were manipulated. The pattern is consistent — connected operational equipment, thin security, physical consequences.
The deeper question is what gets classified as critical. Supermarkets were never treated as infrastructure the way power grids and hospitals are, yet a few hundred compromised controllers emptied the fresh-food aisles of a country in one night. Analyst Steven Lachance, who studies these threats, called the attack a global wake-up call and warned that the next target could be worse: it could target energy infrastructure or hospitals. France's response will set the template — the ANSSI findings, the pressure on Danfoss, the patching of every exposed controller. The cold chain held Europe's food for decades. Now it needs guarding like the power grid.
The Western reading treats this as a governance failure with a price tag. Connected operational technology has outrun the security budgets of the companies running it: franchisees inherited internet-facing controllers from a Danish supplier, patches sat unapplied because downtime costs money, and the bill arrived as destroyed inventory. The fix, in this view, runs through regulation and liability — clearer critical-infrastructure designations, mandatory patching windows, and suppliers held to account when legacy equipment becomes a public hazard.
There is also a resilience argument gaining ground in Brussels. The EU's agriculture commissioner framed the episode as food security, not just cybercrime, and retail associations are pushing the language of supply-chain resilience. In this telling, the freezer aisle belongs in the same policy conversation as the power grid: essential, concentrated, and too important to be guarded by whichever franchisee happened to buy the controller.
The Eastern reading centers on state capacity and industrial dependence. A single Danish vendor's controllers sat inside the cold chain of a major European economy, running firmware nobody maintained, reachable from the open internet. From this angle, the story is about sovereignty over infrastructure: who audits the software inside the machines that feed a nation, and what happens when that audit never occurs. The French prime minister putting ANSSI on the case and coordinating with European counterparts is exactly the state-led response this perspective expects.
It also notes the asymmetry. The attack needed no army and no border crossing — only a known vulnerability and patience. For states that already treat infrastructure as a domain of competition, the freezer attack confirms that the battlefield includes the mundane: food logistics, building controls, maintenance portals. Attribution matters less here than capability: the tooling to do this is now ordinary.
The Global South reading starts with the food, not the firmware. Destroyed fresh stock in a wealthy country is an economic shock; in much of the world it would be a hunger shock. The images of edible food shoveled into trash containers land differently where cold chains are thin and post-harvest losses already run high. For this audience, the lesson is about dependence: the same Danish controllers, the same remote-maintenance portals, and the same unpatched equipment are installed in supermarkets, clinics and warehouses across Africa, Latin America and Asia.
There is also a cost question. When European retailers absorb tens of millions in losses, the expense eventually surfaces in prices, insurance premiums and investment plans — and the security upgrades that follow will be priced for European balance sheets first. Countries that cannot afford to replace legacy equipment will live longest with the vulnerability. The freezer attack, in this reading, is a preview of a risk the South will carry without the cushion.
They seized control of refrigeration management software, made by Danish company Danfoss, that runs a store's fridges and freezers from a central panel. They forced the defrost function — normally a short overnight cycle that melts frost — to run continuously for hours. Temperatures climbed to 50 degrees Celsius, spoiling all fresh and frozen food and, at some stores, overheating the machinery enough to start fires.
Intermarché and its Netto brand were hit hardest, with at least 300 shops targeted. Coopérative U counted nearly 100 outlets, Carrefour reported 80 stores, Monoprix said about five percent of its roughly 490 stores were hit, and E. Leclerc confirmed disruptions at several stores. Specialist retail press also carried unconfirmed reports naming Picard and Metro. Stores running the same Danfoss control platform were hit regardless of brand.
Two supermarkets in Haguenau, Alsace, reported combined losses of 270,000 euros. Intermarché's chief executive told BFM TV the nationwide bill would reach tens of millions of euros in a single day. Every affected store had to discard its entire fresh and frozen inventory, pay for emergency refrigeration repairs, and restock its cold aisles from scratch — costs that fall first on operators, many of them independent franchisees.
Security analysts warn it could. The same pattern — internet-connected control equipment running outdated software — exists across critical sectors. About a dozen US military commissaries suffered similar refrigerator disruptions in late August, and France's ANSSI counted 128 ransomware attacks in 2025. Analyst Steven Lachance called the supermarket attack a global wake-up call, warning the next target could be energy infrastructure or hospitals.
