When the hacker switches off the fridge

On the night of 11 to 12 October 2026, at around 11 p.m., the fridges in a French supermarket started to “defrost”. That alone is perfectly normal: fridges warm themselves up briefly several times a day so they don’t ice over. Except this time the defrost didn’t last one hour. It lasted eight. Staff noticed around 4 a.m. that something was very wrong.

By then the same thing had happened in hundreds of stores.

What happened

According to French authorities and international reports, unknown attackers remotely rewrote the settings of central refrigeration controllers overnight. They extended the defrost cycle from one hour to eight and set the defrost temperature to around 50 °C. Large amounts of fresh and frozen food had to be thrown away, some stores closed temporarily, and fires broke out at several sites. Their cause has not been established.

How many stores? Every source has its own number. Intermarché itself said fridges heated up in about 150 of its stores, while other reports put Intermarché and Netto together at over 300. Carrefour reported 80 stores, and Coopérative U, E.Leclerc and Monoprix were affected too. Overall estimates range from 500 to 700 stores.
Which devices? Mainly Danfoss refrigeration controllers. According to the vendor, most affected units were old and no longer received security updates. Some newer, still-supported units were hit too, because their updates hadn’t been installed.
How big is the damage? Individual stores threw away roughly €100,000–200,000 of goods. The parent company of Intermarché and Netto reports losses of several million euros, and overall estimates run to tens of millions.

The wave didn’t stop after one night. On the night of 12 to 13 October, more stores were hit, this time through another vendor’s (Dixell) controllers, and on 13 October the French national CERT extended its alert to similar Copeland and Dixell devices. Reuters, citing analysis by security firm Sekoia, reported affected refrigeration systems in Spain, Portugal, Poland, Germany and Belgium as well.

Status as of 22 October 2026: nobody has claimed the attack and no culprit has been named. The Paris prosecutor opened an investigation, run by France’s cybercrime office (OFAC) together with the national cyber security agency (ANSSI). CERT-FR updated its recommendations on 16 October and says the campaigns are probably still ongoing. On 12 October one researcher counted 2,752 internet-reachable Danfoss systems, 1,590 of them in France, and Claroty said exposed devices were still online on 14 October.

Why it matters to you

Because nobody thinks about it. In a store, everyone knows the till, the card terminal and the webshop need security. Refrigeration, though, was installed by a maintenance company years ago, and to monitor it conveniently they made the controller’s web interface reachable from the internet. Nobody has touched it since.

This isn’t a French peculiarity. A restaurant’s cold room, an apartment block’s boiler, an office building’s ventilation or a pharmacy’s medicine fridge work the same way. The same pattern shows up at home: a smart boiler, an air conditioner or a camera is also a management interface reachable from the internet, rarely updated, and often still on its default password.

Beyond the countries named above, there’s no public data on affected sites. National agencies are urging operators to check: Hungary’s national cyber security institute (NBSZ NKI), for example, asked stores, cold storage sites and food producers on 14 October to see whether their controllers are reachable from the internet and run current software.

Red // attacker's view

From the attacker’s side, this isn’t a sophisticated hack. What matters:

Find the device. Public internet-scanning search engines show exactly where such controllers are running. In August 2026, Claroty researchers counted 2,765 internet-reachable management interfaces for Danfoss’s newer controllers alone.
Get in. There are several ways: an old unpatched flaw, a default or leaked password, or a maintenance company’s access. Which one was used here isn’t known yet.
No code needed. Once you’re in, defrosting is a normal setting. You don’t break anything, you just change a number.
The alarm goes quiet. During defrost the system expects higher temperatures, so it alerts later. Eight hours of defrost means nobody gets notified overnight.

That’s the point: the attacker turned the system’s own legitimate feature against the store. The best trap is the one the defender built in himself, without thinking someone else might use it.

Blue // what to do now

At home:

If the fridge aisle is empty, don’t be annoyed. The store threw the food away so you wouldn’t get spoiled products.
Go through your smart home devices: boiler, air conditioning, cameras. Change default passwords and turn on automatic updates.
If you don’t use remote access, switch it off in the device’s app.

If you run a store, restaurant, office or apartment block:

Ask your maintenance company today where from and how they reach the controllers for refrigeration, heating and ventilation. If the answer is “over the internet, on a website”, that’s a problem.
Controllers shouldn’t be directly reachable from the internet. Remote access only through a VPN, with logging.
Update, change passwords, retire the old: firmware updates, replace default passwords, replace unsupported devices.
Add an independent thermometer with alarms that doesn’t depend on the system it’s meant to watch.

For professionals: technical details

Affected products (CERT-FR alert, first issued 12 October 2026, extended 13 October, last updated 16 October): Danfoss AK-SC and AK-SM series, Copeland xweb, Dixell xweb. Danfoss confirmed that the affected units were largely old, end-of-life AK-SM800 and AK-SC355 models; some unpatched AK-SM 800A units were hit as well.
Known vulnerabilities (Claroty Team82, 9 August 2026, Danfoss AK-SM 800A): CVE-2025-41450 (authentication bypass, CVSS v3 8.2), CVE-2025-41451 (authenticated command injection, CVSS v3 7.6), CVE-2025-41452 (configuration change and denial of service, CVSS v3 5.4). Fixed in firmware R4.3.1 or later. Whether they were exploited in this attack has not been confirmed; Hungary’s NBSZ NKI notes that legitimate maintenance access with enough privileges would have been sufficient to change the settings.
Recommendations (CERT-FR, NBSZ NKI): remove internet exposure (including on public IPs); remote access only via VPN or a protected network; vendor IP allow-listing is only a stopgap. Review the full configuration, including defrost schedules. On Danfoss devices, enable “Strict” security mode and change default passwords. For compromised devices, preserve logs and configuration first, then restart or factory reset and reconfigure. For end-of-life devices without fixes, a reset isn’t enough because they can be compromised again: replace them. CERT-FR also advises checking insurance terms before cutting the contractor’s data link.
Detection: monitor defrost cycles and configuration changes, alert on unusual values, and measure temperature independently of the central management system, with local safety limits.

Péter // the chief's note

For a long time we’ve treated physical security and cybersecurity as if they were two separate professions. One is about locks, cameras and access gates, the other about servers, passwords and networks. This case shows how outdated that split is.

Look at what happened. Nobody broke into a single store. Nothing was taken, no door was forced, not one camera was damaged. Yet some stores threw away tons of food, overall losses are estimated in the tens of millions of euros, and in places fires broke out. All of it by changing one setting: the defrost ran for eight hours instead of one.

A digital attack caused entirely physical damage here. And the refrigeration controller sits right on the border nobody feels responsible for: the store manager thinks of the maintenance company, the maintenance company thinks of convenient remote access, and IT doesn’t even know it exists. That’s how it could stay open for years.

This applies to everyone, not just supermarkets. An apartment block’s boiler, an office’s ventilation, your air conditioning at home or your alarm system work the same way. If you check one thing in your own surroundings tomorrow, don’t make it your laptop. Check who can reach your boiler, your alarm and your fridge, and from where.

What happened

Why it matters to you

Sources