A supermarket refrigeration hack hit an estimated 700 stores across France this week, spoiling food and triggering electrical fires in some locations after attackers pushed refrigerators to temperatures as high as 50°C (122°F) . Security researchers said basic protections would have prevented access to the systems.
Key takeaways
Refrigeration systems in six European countries were reportedly affected.
Attackers exploited remotely accessible controllers with known security weaknesses.
Researchers identified patching, VPNs and restricted access as preventive measures.
According to Ars Technica , French authorities said attackers compromised internet-connected controllers used by technicians to manage entire fleets of supermarket refrigerators and freezers. The attackers activated defrosters and left them running long enough to spoil perishables and, in some cases, set electrical systems on fire.
Supermarket refrigeration hack spread beyond France
The disruption extended to Spain, Portugal, Poland, Germany and Belgium , as well as France . Reuters reported that geographic spread based on analysis by Sekoia Threat Detection and Research, according to Facilities Dive reporting republished by Yahoo.
The same reporting said hackers locked refrigeration equipment into defrost mode for several hours, forcing hundreds of European supermarkets to discard groceries on October 12, 2026.
An estimated 150 refrigeration units operated by Intermarché were affected. Reports also identified equipment in stores belonging to Carrefour, Coopérative U and E Leclerc.
In a statement posted on X on October 12, Coopérative U CEO Dominique Schelcher described the targeting of equipment essential to preserving fresh food as unprecedented and extremely serious.
Danfoss, Dixell and Copeland controllers targeted
The controller models reportedly compromised were sold by Denmark’s Danfoss, Dixell and its US parent Copeland. Security advisories and public research described critical vulnerabilities that allowed remote users to gain administrator-level access.
Danfoss confirmed that its AK-SM800 and AK-SC355 refrigeration regulator systems were involved, according to Agence France-Presse, as cited by Facilities Dive. The manufacturer described most affected equipment as legacy products that no longer receive software or security updates.
Copeland acknowledged by email a vulnerability “identified in a discontinued, end-of-life generation of controllers” and said it was working with customers to prevent similar incidents. Critical fixes issued in the preceding months for Copeland/Dixell controllers addressed weaknesses that also enabled remote access.
The Danfoss models use Modbus, according to manufacturer documentation cited in the reporting. Facilities Dive noted that cybersecurity specialists have raised concerns about connected building systems that rely on protocols designed decades ago without security in mind.
Predictable passwords and missing protections enabled access
Known authentication weaknesses and outdated firmware left controllers exposed. The affected stores also likely lacked VPN protection and IP allowlisting , which restrict remote access to approved network addresses.
Some Danfoss controllers used a daily password generated from the date by publicly available firmware. Someone examining that code could reproduce the credential for an unpatched device. The same daily password worked across models deployed in hundreds or thousands of stores.
Claroty’s Team82 researchers described a hidden “code-of-the-day” mechanism that bypassed normal authentication. Claroty said it notified Danfoss, which responded that a firmware release addressed the problems.
Researchers at Pen Test Partners said on October 14 that cyber hygiene would have prevented access in the supermarket refrigeration hack. Their recommendations included removing controllers from the public internet, placing remote access behind a VPN and an IP allowlist, changing known or default credentials, and installing current firmware.
They also called for third-party equipment to enter store networks through controlled, documented arrangements rather than a contractor’s separate connection. The US Cybersecurity and Infrastructure Security Agency had issued a related warning in February.
Legacy equipment puts security spending under pressure
The report estimated that losses likely ran into tens or hundreds of millions of euros . It framed the incident as a conflict between replacing aging equipment for security reasons and retaining it when an upgrade offers no immediately tangible savings.
Claroty chief technology officer Amir Preminger told Facilities Dive that the attack should alarm companies handling temperature-sensitive products. He said industrial controllers are often assumed to operate on isolated networks, even though many are directly exposed to the public internet.
Danfoss told AFP it had long advised supermarkets to update firmware on the affected models and move legacy installations to current-generation systems.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
