Most businesses think of cyberattacks in terms of stolen data or locked computers. On the night of 11 October 2026, attackers did something more physical. They took remote control of refrigeration systems in hundreds of French supermarkets, switched fridges and freezers into defrost and heated some of them to as much as 50°C. Food had to be thrown away, and the Paris prosecutor's office said some equipment caught fire.
The incident has been called "unprecedented" by retailers, and it holds lessons for any organisation that relies on connected equipment, from restaurants and pharmacies to factories and offices.
What happened
According to The Hacker News, the attackers reached the fridges through store controllers made by Danish company Danfoss. A single controller runs all of a store's refrigeration, and maintenance firms can manage these units remotely. France's computer emergency response team, CERT-FR, said it was aware of numerous compromises affecting two controller series and told operators to disconnect them or tightly filter access.
Several major chains reported being affected. Al Jazeera, citing AFP, reported at least 300 Intermarché and Netto stores, more than 100 Coopérative U outlets and 80 Carrefour supermarkets among those hit, though the chains' own counts varied between outlets; Coopérative U's chief executive later put his figure at 80 of about 2,000 stores. Intermarché's chief executive told French broadcaster BFMTV that losses would amount to "tens of millions of euros nationwide in a single day". A threat intelligence analyst at Sekoia told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected.
As of 13 October, investigators had not said who was responsible or exactly how the attackers got in.
The uncomfortable detail: old equipment
Danfoss said most of the affected units were older models that no longer receive software or security updates. One had been declared end-of-life in May 2021; another was phased out in 2016. Some current-model units were also hit, and Danfoss said those were running outdated firmware.
This is the heart of the lesson. Commercial equipment such as refrigeration controllers, building management systems and HVAC units often stays in service for many years after the manufacturer stops supporting it. It keeps working, so nobody replaces it. Meanwhile it's connected to the internet for convenience, and attackers keep improving.
Equipment that "still works" is not the same as equipment that is still safe to connect.
This wasn't the first warning
The same family of controllers has been targeted before. According to The Hacker News, a Danfoss newsletter from October 2025 recorded attacks on 16 Russian supermarkets in 2022 and 40 Israeli stores the same year, all 40 of which lacked proper firewall or VPN protection. In August 2026, security researchers at Claroty reported finding thousands of management interfaces for the current controller model reachable from the internet. None of this proves how the French attack happened, but it shows the risk was visible well in advance. Warnings from vendors and researchers deserve a place on the agenda before an incident, not after it.
What went right
Not every affected store lost stock. Coopérative U's chief executive said the cold chain held in most of its affected stores, crediting the quick reaction of store staff and refrigeration contractors. Fast detection and a practised response made a real difference to the losses.
Lessons for every business
1. Know what's connected
Many businesses can list their laptops and phones but not their connected controllers, cameras, sensors and building systems. Make an inventory that includes who installed each device, who can access it remotely and whether it still receives updates.
2. Ask your contractors hard questions
Coopérative U pointed out that its stores didn't buy directly from Danfoss. They were customers of refrigeration contractors. Your supply chain is part of your attack surface. Ask service providers how they secure remote access, what they do about outdated firmware and how fast they would respond to an incident.
3. Take management interfaces off the open internet
CERT-FR's guidance warns that exposing management interfaces to the internet goes against good practice. Where remote access is unavoidable, route it through a single secured entry point and limit it to trusted addresses.
4. Budget for end-of-life replacements
Treat unsupported equipment as a known risk with a deadline. Plan replacements before a crisis forces them on you.
5. Practise the physical response
Cyberattacks on operational systems cause physical harm: spoiled food, damaged equipment, safety hazards. Make sure staff know how to spot abnormal readings, switch to manual control and call the right people quickly.
A recovery checklist from the authorities
For controllers that may have been compromised, CERT-FR set out steps in this order:
- Limit network access to the controllers to service providers only
- Do a factory reset
- Apply all available security fixes
- Change device secrets such as passwords
- Check existing accounts
- Reconfigure the device completely
The order matters. Cutting off access comes first, and full reconfiguration last. The same sequence is a sensible template for any compromised connected device.
Questions to raise at your next management meeting
- Which of our systems could cause physical damage or losses if someone else controlled them?
- Which of those are reachable from the internet, and who approved that?
- How quickly would we notice abnormal behaviour, out of hours?
- Does our insurance cover losses caused by a cyberattack on operational equipment?
The bottom line
The French supermarket attack shows that cyber risk now reaches the cold store, the boiler room and the factory floor. The fixes aren't exotic: know what's connected, keep it off the open internet, replace what can no longer be updated and make sure your contractors meet the same standards. Businesses that treat operational equipment with the same care as their IT systems will be far better placed when the next attack comes.
