Hackers turned supermarket fridges into heaters, and France learned how fragile “always connected” can be.
Story Snapshot
- Paris prosecutors opened a criminal probe into a large-scale cyberattack on supermarket refrigeration.
- France’s prime minister tasked the national cybersecurity agency to investigate and coordinate with Europe.
- Early focus centers on Danfoss controllers with outdated firmware in specific product lines.
- Stores reported abnormal temperatures, food losses, and some fires linked to overheated systems.
What Investigators Say Happened, And Why It Matters
The Paris prosecutor’s office confirmed a criminal investigation into an attack that hit connected refrigerators across several large chains. The anti-cybercrime section is leading the case, with investigators working to identify victims and map losses. Government leaders escalated the response fast. A source close to Prime Minister Sébastien Lecornu said the national cybersecurity agency was tasked to investigate and sync with European partners, showing this went beyond a vendor trouble ticket.
Reports from stores describe controllers pushing cooling units to abnormal temperatures, ruining perishable food and forcing emergency shutdowns. Some sites reported fires as systems overheated, adding life-safety risk to financial loss. This was not a glitch in a lone back room. The pattern spread across multiple brands and regions, which points to remote manipulation of shared technology rather than random equipment failure.
The Equipment In The Crosshairs
Early reporting identified a likely common supplier, with Danfoss systems singled out. Attention focused on the AK-SM800 and AK-SC355 lines, including an AK-SM800 version running outdated firmware. Danfoss acknowledged incidents in France and said affected units were on outdated firmware. The firm said it had urged customers to update supported systems and migrate legacy ones, which aligns with what many field teams see with long-lived building controls.
This focus does not prove the exact intrusion path. Investigators have not released a forensic chain showing how attackers got in or which safeguard failed at each site. That said, the technology profile fits a known operational-technology risk: internet or vendor-facing remote access on devices built to run for years, often with weak patch discipline and limited network isolation.
Food Supply Meets Cyber Reality
Operational-technology attacks cause real-world damage when they jump from screens into equipment. History offers a blunt record: power grid interruptions in Ukraine, malware against safety systems, and shutdowns at energy facilities. The lesson is simple and conservative: critical controls need isolation, strong authentication, and prompt patching, because downtime and safety risks land on families and small businesses first.
Research groups tracking food-sector risk have warned that attacks on refrigeration in warehouses and logistics can spoil products quickly and at scale. The probability is high when remote telemetry and maintenance channels stay open and unguarded. The French incident aligns with those warnings and should move operators to review every exposed control panel and vendor tunnel now, not after a claim hits insurance.
What Comes Next: Accountability And Hard Fixes
Prosecutors will work to connect each store’s losses to specific actions by the attackers and to any exploited weakness in the controllers or networks. The national cybersecurity agency’s technical findings should clarify indicators of compromise, affected firmware versions, and the scope of vulnerable deployments. Danfoss and retailers will face hard questions about patch status, remote access rules, and segmentation between corporate networks and refrigeration controls.
Cyberattack Raised Temperatures in Refrigerators at Hundreds of French Supermarkets colombiaone.com/2026/10/13/france-supermarket-refrigeration-cyberattack/ pic.twitter.com/NK9H0ft4UX
— ColombiaOne (@Co1ombiaOne) October 13, 2026
Practical steps are clear. Operators should isolate control networks, disable open internet exposure, enforce multifactor logins for vendor access, and update or replace legacy controllers that cannot be secured. Store leaders should demand service-level proof: current firmware lists, access logs, and documented recovery plans. Governments should back this with simple rules for connected building systems in essential services. That is not red tape; it is common sense that protects food, jobs, and public safety.
Sources:
townhall.com, dw.com, afp.com, france24.com, insurancebusinessmag.com, tab-beim-bundestag.de
