On the morning of Monday, October 12, 2026, grocery staff across France arrived to restock shelves and opened their freezer doors into a blast of hot air. Overnight, attackers had seized control of the refrigeration systems at hundreds of supermarkets and turned the cold aisles into ovens. Temperatures inside freezers that should have sat well below freezing had been pushed as high as 50 degrees Celsius (122 degrees Fahrenheit). At one store in Normandy, a freezer reportedly hit 80 degrees Celsius (176 degrees Fahrenheit). In some shops, the overheating sparked fires and set off the sprinkler systems.

All of the affected food had to be thrown away.

What happened

The attack struck late on October 11 and ran through the night, hitting while stores were closed and nobody was watching. By Monday morning, the damage was spread across an estimated 400 to 700 locations, according to various reports. The chains hit included Intermarché (around 180 stores, per owner Les Mousquetaires), Carrefour (80 stores), Coopérative U (roughly 80 of its 2,000 outlets), Monoprix (about 5 percent of its shops), and E. Leclerc, along with Netto stores and independents. One worker at an Intermarché in Issy-les-Moulineaux, outside Paris, told reporters the freezers had been pushed to 62 degrees Celsius (144 degrees Fahrenheit): “Everything had to be thrown away.”

Les Mousquetaires told CNBC it expected “several million euros in losses.” Some estimates put the total damage across all chains in the tens of millions.

The response was swift at the official level. The Paris public prosecutor’s office opened an investigation into what it called a large-scale cyberattack. Prime Minister Sébastien Lecornu’s office directed France’s national cybersecurity agency (ANSSI, the Agence nationale de la sécurité des systèmes d’information) to investigate. No individual or group has claimed responsibility. And according to Félix Aimé, a senior cyberthreat intelligence analyst at Sekoia, the attack was not confined to France — refrigeration systems in Spain, Portugal, Poland, Germany, and Belgium were affected as well.

European Commissioner for Agriculture and Food Christophe Hansen condemned the attack publicly, writing that “food security requires more attention at all levels. Because the weaponization of food has become a reality.”

How they got in

Supermarket cold aisles are typically managed by centralized control panels that govern every fridge and freezer in a store. Those panels are connected to the internet so maintenance contractors can adjust settings remotely and receive alerts when something fails. That remote access was the door.

According to ANSSI, the attackers exploited vulnerabilities in controllers made by three vendors: the Danish company Danfoss (specifically its AK-SM800 and AK-SC355 controllers), along with Copeland and Dixell systems. Danfoss confirmed to the industry publication Cooling Post that the affected units were running outdated firmware. The company said it is working with customers on mitigations including firmware updates, stronger network protections, and “removing direct internet exposure where applicable.”

Here is the detail that should alarm everyone: security researchers at Claroty had publicly flagged flaws in at least two of these platforms back in August 2026 — roughly two months before the attack. The warning was out there. The patches were available. Many systems were simply never updated, and their management interfaces stayed reachable from the internet.

How it was (probably) done

Investigators have not yet published the full attack chain, and no group has claimed responsibility — so what follows is the likely playbook based on what has been confirmed, not the official findings. But the shape of it is familiar to anyone who works in industrial security.

Step one: find the targets. Industrial controllers that are reachable from the internet can be found the same way any exposed device is found — by scanning. Search tools that index internet-connected hardware make it trivial to locate specific controller models. These refrigeration panels were deliberately reachable so contractors could dial in remotely, which means anyone else could knock on the same door.

Step two: use the known flaw. The vulnerabilities Claroty flagged in August were public knowledge. Any unit still running the old firmware in October was, in practical terms, already compromised — the attacker just had not arrived yet. This is the part worth sitting with: the break-in likely required no novel exploit, just a published flaw and a target list.

Step three: take the panel. A store’s refrigeration controller is a single point of command for every fridge and freezer in the building. Once inside it, an attacker can rewrite temperature setpoints, trigger defrost cycles at will, and — critically — silence the alarms that would normally page someone when temperatures drift.

Step four: let the night do the damage. The attack ran while stores were closed and dark. With alerts suppressed and setpoints pushed to their maximums, the units heated for hours unchecked. Staff walked into the aftermath on Monday morning: hot air pouring out of freezer doors, ruined stock, and in some stores, smoldering equipment.

What would have stopped it

Each defensive measure below maps to one of the steps above. Any single one might have blunted or broken the attack:

• Patching in August or September would have closed the known flaw before October. Vulnerability management (finding, prioritizing, and fixing known weaknesses) is unglamorous work — and it is the single highest-leverage defense in this entire story.
• Removing the panels from direct internet exposure would have made step one fail. Contractor access through a virtual private network (VPN) or another private channel gives maintenance teams what they need without giving the whole internet a login prompt.
• Segmenting the network would have contained the blast radius. If the refrigeration controllers had sat on an isolated operational network instead of a flat one, compromising a panel would not have been a straight path to every other connected system in the building.
• Alerting on configuration changes would have caught step three in minutes. A temperature setpoint rewritten at 2 AM is not a maintenance window — it is an incident. Someone should have been paged.
• An incident response plan that covers operational equipment would have shortened step four from “all night” to “under an hour.” Most response plans cover laptops and email. The stores that urgently disconnected another hundred locations from the internet on Monday understood, mid-crisis, what their plan had been missing.

Why this matters to a small business

You do not need to run a supermarket chain to be exposed to this exact pattern. The lesson of the French fridge hack is not about groceries — it is about a class of equipment most small businesses never think of as computers.

Walk through your own operation. Do you have a smart thermostat, connected security cameras, a point of sale (POS) system, a networked printer, a smart lock, or any kind of environmental monitoring? Each of those is a small computer on your network, often running old firmware, often reachable in ways you never intended. Attackers do not care whether the device keeps ice cream frozen or keeps the office cool. They care that it is connected, unpatched, and trusted by everything around it.

Three things made this attack possible, and all three are common in small businesses:

1. Known vulnerabilities left unpatched. The flaws were published in August. The attack came in October. Patching operational equipment feels risky and easy to postpone — until postponing becomes the incident.
2. Management interfaces exposed to the internet. Those refrigeration panels were reachable remotely for contractor convenience. Every remote-access path you leave open for convenience is a path an attacker can walk through too.
3. No separation between operational tech and everything else. Operational technology (OT) — the systems that run physical equipment — is often dropped onto the same network as the office laptops. Once an attacker reaches one, they can reach the other.

What a small shop should actually do

You cannot defend what you have not inventoried. Start with a list: every connected device in your business, not just the computers. Thermostats, cameras, door controllers, payment terminals, printers, environmental sensors — all of it.

Then work the list:

• Update firmware on everything connected. Check each vendor’s support site for advisories, the same way you would check for a Windows update. If a device is too old to receive updates, that is your sign to plan its replacement.
• Get management interfaces off the public internet. If a contractor needs remote access, give them a virtual private network (VPN) connection or a dedicated remote-access path — not a login page the whole world can reach.
• Segment your network. Your operational devices should not sit on the same network as employee laptops and guest Wi-Fi (wireless networking). A basic segmented setup means a compromised camera cannot become a stepping stone to your accounting PC.
• Change default credentials. If any device still uses the password it shipped with, change it today. Attackers try the defaults first because they work depressingly often.
• Include physical systems in your incident response thinking. Most small incident response plans cover laptops and email. Ask yourself: if someone locked you out of your building controls, your cameras, or your payment terminals at 2 AM, who would you call and what would you do? Write the answer down before you need it.

None of this requires enterprise software or a security team. It requires treating every connected device as what it is: a computer that happens to also be a thermostat.

The takeaway

The French supermarket attack will be remembered as the week hackers weaponized the food supply — but the technique was ordinary. Unpatched firmware, internet-exposed controls, flat networks. Those are not exotic failures. They are the default state of most small networks, and attackers know it.

The stores that disconnected their remaining systems from the internet within hours of the attack understood the assignment. The question is whether the rest of us learn it from their losses or from our own.

---

If your business runs connected equipment and you are not sure where you stand, book an introductory call. We will talk through what you actually have and what it would take to secure it.

---