The French Supermarket Cyberattack That Turned Fridges Into Ovens

On the night of 11 October 2026, the French supermarket cyberattack did something most people assumed only happened in films: hackers reached into hundreds of stores and cooked the food. The France fridge cyberattack pushed refrigeration systems to around 50°C, forced stores to throw away fresh and frozen stock, and sparked fires in some shops.

Three weeks later, a second wave of freezer cyber attacks hit supermarkets in eight more European countries, and reports now say cold storage used by France's national blood service was targeted too. In this article, we explain what happened, which countries were affected, what caused it and how the attackers most likely got in, and what UK organisations running operational technology (OT) should do now.

What happened in the French supermarket cyberattack?

Overnight on Sunday 11 October 2026, attackers took control of refrigeration controllers in hundreds of French supermarkets and triggered their defrost cycle while the food was still inside. According to reporting by Bloomberg and others, fridges and freezers reached about 50°C (122°F) for roughly six hours. Meat, frozen goods and vegetables had to be binned, and several stores reported fires. The Paris prosecutor's office opened an investigation into what it called a "large-scale" cyberattack.

Among the chains affected were Intermarché, Coopérative U, E.Leclerc, Carrefour and Monoprix. Intermarché's owner said around 150 of its stores were hit. Carrefour said 80 of its stores were affected, and Monoprix said 5% of its roughly 490 stores were hit. Estimates for the total number of French stores vary between outlets, from a few hundred to higher figures, so we have not relied on a single number.

Which countries were affected?

France was hit first, but it was not the last. On the night of 1 to 2 November 2026, a second wave of refrigeration attacks was reported across several European countries. Based on reporting from AP, Reuters, NBC News and others, the countries affected so far are:

• France (11 October): hundreds of supermarkets, the largest incident so far.

• Belgium (1 to 2 November): around 40 Delhaize stores, 15 of Carrefour's 700 Belgian stores, five Spar shops operated under Colruyt Group's franchise system, and an IKEA store. Euronews put the Belgian total at around 75 stores.

• Luxembourg: Delhaize stores were among those hit.

• Sweden: ICA said a limited number of stores were affected, and Coop said 7 of its 800 stores were hit. Coop has since disconnected the affected refrigeration systems from the internet.

• The Netherlands: Danfoss said at least 17 businesses, mainly butchers and small local shops, were hit. Large supermarkets were reportedly unaffected.

• Ireland: 13 SuperValu stores, according to owner Musgrave.

• Estonia: at least one Selver store.

• Finland: reported by the BBC, with fewer details available.

• Germany: Edeka said fridges at one store in Reisbach were hacked. Its stores are run by independent retailers, with no standardised refrigeration system across the network.

As of 4 November, no UK supermarkets had been reported hit. However, Richard Horne, chief executive of the UK's National Cyber Security Centre (NCSC), said hackers tried to target small meat-processing firms in Britain, but the impact was minimal. He also said there had been some instances in the UK as well as in Europe, and that the NCSC is working with organisations to spot vulnerabilities and close them before somebody exploits them. Figures may change as more information emerges, so treat these as a snapshot.

What caused the freezer cyber attack?

The freezer cyber attack was caused by attackers taking control of internet-connected refrigeration controllers, many of them older and no longer receiving security updates. France's CERT-FR named the hardware involved: the Danfoss AK-SM and AK-SC controller series, plus Copeland XWEB and Dixell XWEB units. Danfoss said that many of the affected units were running outdated firmware or no longer received software or security updates, and that it had long advised customers to update supported systems and migrate legacy ones.

The attackers then used a built-in feature as a weapon. Rather than breaking the fridges, they triggered the controllers' automatic defrost cycle, which warms the units on purpose, and kept it running while the stock was inside.

A quick caution on vulnerabilities. Researchers at Claroty reported security flaws in a related Danfoss refrigeration controller earlier in 2026, but at the time of writing neither CERT-FR nor Danfoss has publicly tied the attacks to a specific CVE. What has emerged is evidence of weak and default logins. Security firm Lupovis told SecurityWeek that between 20 and 30 October its honeypots saw login attempts against Danfoss AK-SM controllers, mostly using factory-default credentials that Danfoss documents publicly.

Security researcher Kevin Beaumont has said several thousand Danfoss management systems are reachable from the internet with very weak login security, and Censys counted just over 1,000 Danfoss StoreView interfaces online worldwide, with exposed instances in France falling from 1,825 to 220 since the first attack. In our professional opinion, this shows default credentials are being tried, but it is not confirmed as how the French or later attacks succeeded, so we would wait for official findings before assuming a single cause.

How did the attackers get in?

The most likely way in was the controllers' own web interface, reachable from the public internet. Reuters reported that supermarket refrigeration panels are typically accessible online so that maintenance companies can adjust them remotely, and three cyber experts told the agency the attack appeared to be easy to carry out. A former official from ANSSI, France's national cyber agency, said there was no business need for these controllers to be exposed to the public internet.

Several details point to the supply chain as an important factor:

• Retail groups said their refrigeration was managed by suppliers and contractors. Coopérative U's chief executive said his stores buy from refrigeration contractors who supply the Danfoss systems, not from Danfoss directly.

• In Sweden, ICA said the affected stores used an external supplier with connectivity outside ICA's central network.

• In Belgium, an installer said some affected units could not be fixed with a simple software update and needed hardware changes.

In our experience across IT and OT, this is a very familiar pattern: equipment installed years ago, maintained by a third party, reachable remotely, and outside the main IT security programme. We want to be clear that no full public technical report on the intrusion exists yet, so this is our reading of the reporting, not confirmed fact.

How much damage did the French supermarket cyberattack cause?

The damage was mostly physical and financial: destroyed stock, damaged equipment and some fires. Two supermarkets in Alsace reportedly lost around €270,000 of stock between them, and estimates for the total cost in France run into the millions of euros. French retailers called the targeting of food-preservation equipment "unprecedented", and the EU's agriculture and food commissioner condemned the attack.

There is a wider lesson here. The attackers did not need to steal data or encrypt systems. They changed how a physical machine behaves, and that was enough.

Did the attacks reach blood storage and healthcare?

Reports suggest they came close. French media reported that cold-storage facilities used by France's national blood service (EFS) were also hit. Coolworld, a company that stores containers for EFS as part of a health monitoring system linked to blood transfusions, was among the companies affected. Local media said the controllers were programmed to climb to as high as 110°C from the usual -30°C. The temperature rise was spotted in time, and France's Health Ministry said the incident caused no operational consequences for blood supplies thanks to early detection.

In our professional opinion, this is the part of the story that matters most for critical infrastructure. Supermarkets lose stock and money. Healthcare and other cold-chain operators can lose things that are far harder to replace.

Who is behind the France fridge cyberattack?

Nobody knows yet. No group has publicly claimed responsibility. The Paris prosecutor's office and ANSSI are investigating, and authorities in Belgium and Sweden said they were monitoring the second wave. The EU's cybersecurity agency, ENISA, said the scale of the attacks underscores the need for European cooperation, rapid information-sharing and coordinated responses.

Asked whether Russia or Iran might be behind them, the NCSC's Richard Horne said that at this stage nobody knows, and that it could be states or criminals. Separately, about a dozen US military commissaries reported refrigeration problems and food losses in late August, and the Pentagon has said it is investigating. Reports say authorities are sharing information, but nobody has established that these incidents are connected. We would not speculate on attribution until there is evidence.

Why does this matter beyond supermarkets?

Because fridge controllers are OT, and OT runs the physical world. Operational technology is the hardware and software that monitors and controls physical processes, from refrigeration and building systems to production lines, utilities and railways. These systems are often long-lived, rarely patched and connected for remote maintenance.

In our professional opinion, the French supermarket cyberattack shows three risks that apply across critical infrastructure and transport:

• Remote access is the front door. If a device can be managed remotely, it can be attacked remotely unless access is tightly controlled.

• Third-party access is part of your attack surface. The supplier's connection is your connection.

• Old equipment keeps its risks for years. Unsupported controllers do not become safe because they are still working.

We see the same ingredients in the environments we work in, including rail: remote vendor access, long-lived legacy systems and networks that are not well separated. We make the same point in our analysis of The Gentlemen ransomware, where remote access also sat at the heart of the risk.

Is the UK at risk from a freezer cyber attack?

No UK supermarkets had been reported hit at the time of writing, but we think UK organisations should treat this as a live warning. The NCSC's Richard Horne said hackers tried to target small meat-processing firms in Britain with minimal impact, and called the supermarket attacks an early sign of what are likely to be more frequent disruptions as old technology fails to keep pace with attackers.

He pointed to years of underinvestment in operational technology, with many organisations running equipment beyond its intended life, without upgrades and without keeping it isolated from the internet. He also stressed that responsibility for protecting systems ultimately sits with each organisation. We would suggest checking the NCSC website for the latest guidance, and asking your suppliers directly whether any of the named products are in your estate.

What should organisations do now?

The priority is to find out what you have, take it off the open internet and plan for failure. Danfoss has recommended that systems should not be directly accessible via the internet, and Frank Groenewegen, a cybersecurity expert at Deloitte, said that anyone who does not know whether their controllers are exposed should remove them from the public internet immediately. He added that disconnecting does not fix the root cause, but it does isolate the systems so an attacker can no longer reach them. Based on our experience, here is where we would start:

1. Find every connected controller. List refrigeration, HVAC, building management and other OT devices, including ones installed and managed by suppliers. Check specifically for Danfoss AK-SM and AK-SC, Copeland XWEB and Dixell XWEB.

2. Check internet exposure. Establish whether any controller's web interface can be reached from outside your network.

3. Remove public access. Place controllers behind a VPN or secure remote-access gateway with multi-factor authentication, and change any default or factory-set passwords.

4. Update or replace. Apply supported firmware, and make a plan for equipment that no longer receives updates. Some units may need hardware replacement.

5. Question your suppliers. Ask who can reach your equipment, how, and how that access is secured and logged.

6. Separate and monitor. Keep OT on its own network segment, and watch for unusual changes such as unexpected defrost cycles or temperature set-points.

7. Plan for a manual fallback. Make sure you have independent temperature alarms and a rehearsed response, so staff can act even if the network cannot be trusted.

If you need help knowing where to start, a risk and gap analysis can map your exposure, and our IT/OT cybersecurity and third-party and supply chain risk work focuses on exactly these remote-access and supplier connections. For continuous visibility, see our SOC as a Service, and if something does go wrong, our incident response team can help.

Frequently Asked Questions

What was the French supermarket cyberattack?

It was an attack on the night of 11 October 2026 in which hackers took control of refrigeration controllers in hundreds of French supermarkets and raised temperatures to around 50°C, spoiling food and causing fires in some stores.

Was the France fridge cyberattack ransomware?

No group has claimed it, and reporting describes it as tampering with equipment rather than data theft or file encryption. We have not seen a ransom demand reported in the sources we reviewed.

Which brands of equipment were affected by the freezer cyber attack?

CERT-FR named the Danfoss AK-SM and AK-SC series, plus Copeland XWEB and Dixell XWEB controllers.

Which countries were affected?

France in October, then eight more countries in the second wave on 1 to 2 November: Belgium, Luxembourg, Sweden, the Netherlands, Ireland, Estonia, Finland and Germany.

Were any UK stores affected?

No UK supermarkets had been reported hit at the time of writing. The NCSC's Richard Horne said hackers tried to target small meat-processing firms in Britain, but the impact was minimal, and that the NCSC is working with organisations to find and close vulnerabilities.

French bloodbank affected by 2026 cyberattack

Reports say cold storage used by France's national blood service was hit and the fridge temperatures were programmed to rise sharply. The rise was spotted in time, and France's Health Ministry said there were no operational consequences for blood supplies.

How did the hackers get into the fridge controllers?

The most likely route is the controllers' web interface being reachable from the internet, with weak or default logins being probed, but no full public technical report has been released yet.

Can a software update fix the problem?

Sometimes. Danfoss said many affected units were outdated and no longer received security updates, and a Belgian installer said some units needed hardware changes rather than a simple update.

Who is responsible for the attacks?

Nobody has been publicly identified. French and other authorities are investigating, and no link between this and other incidents, such as those at US military commissaries, has been established.

Final thoughts

The French supermarket cyberattack is a reminder that cyber risk is no longer only about data. When internet-facing controllers manage physical equipment, a few commands can destroy stock, damage assets and cause fires, without a single file being encrypted. The fix is not exotic: know what is connected, close the doors that do not need to be open, hold suppliers to account, and have a plan for when the network cannot be trusted.

If you would like to understand how exposed your own OT, building systems or supplier connections might be, we are happy to talk it through. With 12 years of experience securing IT and OT, including in the railway sector, our team can help you work out where to start. Book a free consultation and we will start with a conversation, not a sales pitch.