Hackers Warmed Hundreds of French Supermarket Fridges, Spoiling Food

Key takeaways

• Attackers remotely raised refrigerator temperatures at hundreds of French supermarkets by hijacking internet-connected Danfoss controllers.
• Operational technology like refrigeration, HVAC, and building controls now shares the same cyber risks as traditional IT systems.
• Businesses should inventory all internet-connected equipment, segment OT networks, and require multi-factor authentication for remote vendor access.
• Monitoring for anomalies like unusual temperature changes or off-hours configuration adjustments can help detect attacks early.
• Regulatory and insurance pressure around OT security is likely to increase following incidents like this.

What happened

On the night of October 11, attackers remotely took control of refrigerators and freezers at hundreds of French supermarkets and warmed them. Several retail chains (https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html) confirmed the breach and resulting food loss the next day. Temperatures reportedly climbed as high as 50°C (https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html), forcing stores to throw away perishable inventory.

The attackers reached the fridges through controllers made by Danish company Danfoss. These devices manage all of a store's refrigeration units and are designed to allow maintenance firms to monitor and adjust settings remotely. The cyberattack reportedly targeted these Danfoss refrigeration controllers (https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/), which are connected to the internet to enable remote management.

Retail groups including Les Mousquetaires confirmed the incident. The attackers exploited the remote access capability built into the controllers, turning a maintenance feature into an attack vector.

Why this is an issue

Most business owners think about cybersecurity in terms of computers, email, and payment systems. This attack demonstrates that internet-connected operational technology, the systems that control physical processes like refrigeration, HVAC, and manufacturing equipment, presents just as much risk.

Operational technology (OT) networks were historically isolated. A refrigeration controller sat on its own network, unreachable from the outside world. As vendors added remote monitoring and management features to reduce service costs and improve response times, they connected these systems to the internet. That connectivity creates opportunity for attackers.

The consequences here were economic and logistical. Stores lost inventory and revenue. Employees spent hours disposing of spoiled goods and restocking. But the same pattern of attack, applied to different OT systems, could threaten safety. Industrial control systems, building automation, water treatment, and energy infrastructure all rely on similar internet-connected controllers.

The French supermarket breach also highlights a trust problem. The retailers likely had contracts with maintenance firms who accessed the controllers legitimately. Once attackers compromise the controller itself or the remote access pathway, they inherit the same privileges as the authorized technician. There is often no secondary authentication or anomaly detection to block an instruction that raises a freezer to 50°C in the middle of the night.

What you can do about it

If your business uses internet-connected equipment to manage physical operations, refrigeration, climate control, access systems, or production lines, take these steps.

Inventory your operational technology. Work with your facilities and operations teams to list every piece of equipment that connects to the internet or your network. Include HVAC controllers, refrigeration systems, security cameras, door locks, and any manufacturing or process control hardware. You cannot secure what you do not know exists.

Segment OT networks. Operational technology should sit on a separate network from your corporate IT systems. If an attacker compromises a laptop or email account, they should not be able to pivot directly to your refrigeration controllers. Your IT provider or a qualified systems integrator can design this segmentation.

Require multi-factor authentication for remote access. Any vendor or maintenance firm that manages your OT systems remotely must use multi-factor authentication. A username and password alone is not enough. If your equipment vendor does not support MFA on their remote management platform, ask when they will. Make it part of your purchasing criteria going forward.

Monitor for anomalies. A refrigerator that suddenly heats to 50°C at midnight is abnormal. So is an HVAC system that shuts down outside of scheduled maintenance windows. Set up alerts for out-of-range temperatures, unexpected shutdowns, or configuration changes outside of business hours. Many modern OT platforms include basic anomaly detection. If yours does not, consider a third-party monitoring tool or a manual log review process.

Review vendor access. Know which third parties have remote access to your systems, what they can do, and when they typically log in. Revoke credentials for vendors you no longer use. Audit access logs quarterly.

If you operate a retail or food service business with networked refrigeration, check with your refrigeration maintenance provider now. Ask which controller models you have installed, whether they are internet-accessible, how access is secured, and whether the vendor has issued any security updates in response to this incident.

Where this is heading

Attacks on operational technology are not new, but they are becoming more common as connectivity spreads. Ransomware groups have targeted industrial control systems. Nation-state actors have probed energy and water infrastructure. Opportunistic attackers scan the internet for exposed controllers with default credentials.

Expect regulatory pressure to increase. Industries that handle food safety, healthcare, and critical infrastructure will face new requirements for OT security. Insurers will start asking about network segmentation and remote access controls before writing cyber policies.

Vendors will also respond. Danfoss and similar manufacturers will likely accelerate security features like mandatory MFA, encrypted communications, and anomaly detection. Businesses that wait for vendors to act, however, leave themselves exposed in the meantime.

Our read is that this attack was designed to cause disruption and economic damage, not to steal data or hold systems for ransom. That makes it harder to attribute and harder to deter. It also means the attackers may not discriminate by industry or size. Any organization with accessible OT is a potential target.

The lesson for business owners is straightforward. If it is connected, it can be compromised. Treat your operational technology with the same rigor you apply to your financial systems. The cost of inventory loss, downtime, and reputational damage far exceeds the cost of segmentation, monitoring, and access controls.