French Supermarket Cyberattack: Hackers Turned Freezers Into Ovens

By the Ingenious AI team · October 13, 2026 · 8 min read

On Monday morning, staff at hundreds of French supermarkets walked into stores that smelled wrong. Overnight, hackers had remotely triggered the forced defrosting of refrigeration systems across the country. Freezers that should have held at -18°C had climbed to 50°C — 122°F. Every fresh and frozen product in the affected stores had to be thrown away. Some stores caught fire.

Intermarché's CEO called it "unprecedented" and put the damage at tens of millions of euros — in a single day. Carrefour, Monoprix, E. Leclerc, and Coopérative U were hit alongside Intermarché and its Netto brand: more than 300 Intermarché/Netto shops, over 100 Coopérative U outlets, 80 Carrefours. France's prime minister ordered the national cybersecurity agency, ANSSI, to investigate. The Paris prosecutor opened a case. This is the largest attack on food-supply infrastructure Europe has seen, and it holds lessons for anyone with connected equipment — which, in 2026, is nearly everyone.

What actually happened

The short version: the attackers didn't break into a corporate network and pivot for weeks. They went straight at the machines.

Modern supermarket refrigeration runs through control panels that manage an entire store's fridges and freezers from one place. Those panels are reachable over the internet, deliberately — maintenance companies need to adjust temperatures and diagnose faults without driving to every store. According to investigators, the attackers found a vulnerability in refrigeration management software supplied by the Danish company Danfoss and used it to issue a single devastating command: defrost everything.

Danfoss says the affected units were running outdated firmware, and that it has "long advised customers" to update. That sentence will sound familiar to anyone who has read a breach post-mortem. The pattern is always the same: a known fix exists, the update never gets applied, and the vulnerable units sit on the public internet for years until someone knocks.

The 60-second version

Hackers exploited a vulnerability in internet-connected refrigeration controllers used by major French supermarket chains, remotely forcing freezers into defrost mode overnight. Temperatures hit 50°C, destroying all fresh and frozen stock in hundreds of stores and starting fires. Losses run to tens of millions of euros. The vulnerable units ran outdated Danfoss firmware on internet-exposed management panels. If you operate any internet-connected equipment, this attack is your warning: update firmware, authenticate every management interface, and segment IoT devices off your main network.

Why this attack worked

Strip away the supermarket specifics and the attack has three ingredients. You'll recognize them from nearly every major IoT incident of the last decade:

1. A management interface on the public internet with weak or no authentication. The refrigeration panels were reachable remotely by design. Remote access for maintenance is legitimate — remote access without strong authentication is an invitation. Investigators are still establishing exactly how the attackers got in, but internet-facing industrial controllers are routinely found with default credentials or unpatched flaws.

2. Outdated firmware on identical units everywhere. When hundreds of stores run the same controller with the same old firmware, one vulnerability becomes a skeleton key for the whole fleet. Attackers love monocultures. The fix existed; it just wasn't installed.

3. No monitoring of the commands that matter. A defrost command issued at 2 AM across hundreds of stores simultaneously is not a normal maintenance event. Nobody was watching for it. Detection doesn't require AI or exotic tooling — it requires someone to define "this command, at this hour, at this scale, is impossible" and alert on it.

This is the same week as the AI replication warning

The timing is worth noting. Days before the supermarket attack, Anthropic published research warning that small AI models may be months away from self-replicating across poorly secured IoT devices — smart ovens, cheap Android TV boxes — hopping from device to device over unauthenticated management ports, with "no centralized point to shut off."

Read the two stories together and the picture sharpens. The French attack shows what happens when connected devices with weak security meet a motivated attacker today. The Anthropic warning describes what happens when the attacker itself becomes software that can figure out unfamiliar devices on its own. The defense is the same in both cases: every management interface authenticated, every device's firmware current, every fleet segmented, every anomalous command monitored. The window for treating IoT security as optional is closing from both directions at once.

What to do about your own connected devices

You don't need a supermarket to be exposed. Offices have smart HVAC, warehouses have connected inventory systems, clinics have networked equipment, and nearly every business has cameras, printers, and routers with web interfaces. Here's the checklist:

Inventory every internet-facing device. You can't secure what you don't know about. List every device with a management interface: cameras, thermostats, controllers, printers, NAS boxes. Note which ones are reachable from the internet and why.

Update firmware now, then on a schedule. The Danfoss units were compromised through outdated firmware with a known fix. Put every connected device on a quarterly update cycle, minimum. If a vendor stops shipping updates for a device, that device goes on an isolated network or gets replaced.

Authenticate every management interface — no exceptions. Change every default password. If a device doesn't support real authentication, it doesn't belong on a network with anything valuable. Remote maintenance access should go through a VPN, not the open internet.

Segment IoT off your main network. Refrigeration controllers have no business being able to reach your point-of-sale systems or office file shares. A separate VLAN for connected devices limits any single compromise to the devices themselves.

Monitor the commands that matter. Define the impossible events for your equipment — mass configuration changes, commands at unusual hours, firmware flashes from unexpected sources — and alert on them. The French attackers issued a fleet-wide defrost at night. That should have paged someone within minutes.

Plan the response before you need it. When connected equipment is compromised, the response crosses IT and operations: who can physically disconnect the devices, who talks to the vendor, who decides whether food (or product, or patient data) is safe. Write it down now.

The bottom line

Hundreds of stores, tens of millions of euros, fires in the frozen aisle — all from a vulnerability with an available fix, on devices that never should have been reachable without strong authentication. The attackers didn't need anything sophisticated. They needed their targets to skip updates and leave the door open.

That is the entire lesson. The threats are getting more capable — self-replicating models are on the horizon — but the defenses that would have stopped this attack are unglamorous and available today: current firmware, authenticated interfaces, segmented networks, monitored commands. Do those four things and you're ahead of most of the organizations in the headlines.

At Ingenious AI, we build Rogue-Agent Defense to catch exactly this class of problem: connected systems doing things they should never do. We're currently shipping a self-replication containment module — exposure scanning for unauthenticated management interfaces, anomaly detection on device commands, and kill-switch playbooks for when something spreads. See what it watches for.

Frequently asked questions

What happened in the French supermarket cyberattack?

Overnight between October 11 and 12, 2026, hackers remotely triggered forced defrosting on connected refrigeration systems in hundreds of French supermarkets. Freezers reached 50°C (122°F), destroying fresh and frozen stock and causing fires at some stores. Intermarché, Carrefour, Monoprix, E. Leclerc and Coopérative U were hit; losses are estimated in the tens of millions of euros in a single day.

How did hackers access the supermarket refrigeration systems?

Store refrigeration is run by control panels that manage every fridge and freezer in a building and are reachable over the internet so maintenance companies can adjust them remotely. France's cybersecurity agency ANSSI identified a vulnerability in refrigeration software from Danish supplier Danfoss; the affected units were running outdated firmware.

How can businesses protect IoT devices from cyberattacks?

Keep firmware updated, require authentication on every management interface, segment IoT devices onto isolated networks, monitor for unusual remote commands, and maintain an incident response plan for connected equipment. The French attack succeeded through outdated firmware on internet-exposed control panels — both failures are preventable.

Are IoT cyberattacks increasing?

Yes. The same week as the French supermarket attack, Anthropic warned that small AI models may soon self-replicate across poorly secured IoT devices like smart ovens and Android TV boxes. Internet-connected devices with weak default security are increasingly attractive targets because one vulnerability can affect thousands of identical units at once.

← All guides