The short answer
The French fridge attack is a legacy-equipment problem: unsupported controllers were reachable from the internet and nobody owned their updates. On the night of October 11–12, 2026, attackers forced long defrost cycles on Danfoss refrigeration controllers, spoiling stock in several hundred stores. Paris prosecutors and France’s cyber agency ANSSI are investigating.
For companies that build or run connected equipment, the lesson is about lifecycle, not about refrigeration. A controller sold a decade ago, still wired into a store network and still reachable remotely, is part of your attack surface even if no one has touched its software in years. Teams that do embedded and firmware development for connected devices should treat secure remote access, signed updates and an end-of-life plan as product features from the first release.
What happened in French supermarkets?
Staff arriving on Monday morning found chilled and frozen display cases warm and stock spoiled. According to Reuters and TIME, the attackers did not switch the units off. They triggered continuous or extended defrost cycles, which heat the cases on purpose and are designed to run for short periods without raising an alarm. Stretching those cycles to several hours overnight was enough to ruin fresh and frozen food before anyone noticed.
Retailers described the attack as unprecedented. Coopérative U’s president called it “an extremely serious matter,” and Intermarché said the incident appeared to affect a service provider that manages refrigeration in its stores. The French prime minister asked ANSSI to investigate, and the agency is coordinating with other European cyber authorities.
The same Monday, Dutch retail group Ahold Delhaize took some of its systems offline after a separate security issue, disrupting websites and online orders for Albert Heijn in Europe and for Food Lion, Stop & Shop and other US chains. Investigators have not linked the two incidents, but together they show how much of food retail now depends on connected systems.
How could attackers reach the fridges?
The exact entry point has not been published. What is known points to old, exposed equipment. Danfoss told French media that most of the affected devices were obsolete models that “no longer receive software or security updates,” and that it is helping customers with firmware updates where available, stronger network protection and removing direct internet exposure.
Researchers had already flagged the risk. In 2025, CISA published advisories on Danfoss AK-SM 800A controllers, including CVE-2025-41450, an authentication bypass that Claroty’s Team82 reported and that is fixed in firmware R4.2. Danfoss has not said whether that or any other published flaw was used. Internet scans run after the attack, cited by BleepingComputer, found thousands of Danfoss management interfaces still reachable online, more than half of them in France.
What it means for US & EU software teams
First, end of life is a security event, not just a sales notice. Equipment that stops receiving updates keeps running for years in stores, warehouses, clinics and plants. If you ship connected products, publish support periods clearly, give customers a migration path and make the device fail safe when it can no longer be patched. In the EU, the Cyber Resilience Act’s reporting duties for actively exploited vulnerabilities in products with digital elements have applied since September 11, 2026, and its full requirements, including a declared support period, follow in December 2027.
Second, remote management must not mean internet-facing management. Vendor and integrator access to field devices should go through authenticated gateways or VPNs with per-user accounts and logging, not through web interfaces exposed on public IPs. That applies to refrigeration, HVAC, building automation and the cloud dashboards that sit on top of them.
Third, OT now falls under the same rules as IT. Large food distribution and retail operators are in scope of NIS2 in the EU, which expects risk management across suppliers and connected systems. In the US, retailers and their equipment vendors face growing pressure from insurers and customers to show an inventory of operational technology, not just laptops and servers.
What should teams check this week?
- Search for your own exposure. List public IPs and check which controller, building management or device dashboards answer from the internet.
- Build an OT and IoT inventory. Record model, firmware version, support status and owner for every connected device that controls a physical process.
- Put remote access behind a gateway. Replace direct web access with VPN or zero trust access, unique accounts, MFA where supported, and logged vendor sessions.
- Plan replacements for end-of-life units. Where a device cannot be patched, isolate it on its own network segment and schedule its retirement.
- Alert on abnormal process behavior. Monitor for setpoint changes, unusually long defrost or maintenance cycles and logins at odd hours, not only for devices going offline.
Frequently asked questions
What happened to French supermarkets on October 11-12, 2026?
Overnight from Sunday October 11 into Monday October 12, attackers remotely manipulated refrigeration controllers in French supermarkets, forcing long defrost cycles that pushed display case temperatures to around 50°C (122°F). Chains including Intermarché, Coopérative U, Carrefour, Monoprix and E.Leclerc reported affected stores, food had to be thrown away and some fires were reported.
How many stores were affected?
Counts differ between reports and are still being compiled. Store-by-store figures from retailers and media add up to several hundred French stores, with estimates ranging from roughly 250 to more than 350. Reports also point to affected sites in other European countries.
Which equipment was involved?
Danfoss refrigeration controllers. Danfoss told French media that most affected devices were obsolete AK-SM800 systems (end of life since 2021) and AK-SC355 systems (phased out in 2016), and that some current AK-SM800A units were running outdated firmware. Danfoss has not said which vulnerability, if any, was used.
Who is investigating?
The Paris prosecutor’s office opened a criminal investigation, and France’s national cybersecurity agency ANSSI is investigating with European counterparts. No group had credibly claimed responsibility at the time of writing.
Is this linked to the Ahold Delhaize incident?
No link has been established. Ahold Delhaize separately took some systems offline on October 12, 2026, which disrupted websites and online ordering for chains such as Albert Heijn, Stop & Shop and Food Lion, but the two incidents have not been connected by investigators.
Sources
NBC News / Reuters — Hackers heat French supermarket fridges, sparking fires and spoiling food
TIME — ‘Unprecedented’ cyberattack targets French supermarket fridges
CNBC — French supermarket fridges get hacked, heating to 122°F and sparking fires
BleepingComputer — Cyberattack shuts down refrigerators at French supermarkets
CISA — ICS advisory ICSA-25-140-03, Danfoss AK-SM 8xxA Series