On the night of October 11–12, the fridges and freezers inside hundreds of French supermarkets began to heat up. Nobody walked in and turned a dial. Nothing broke. The cooling systems did exactly what they were told, because someone far away had taken over the controllers that run them.
Temperatures climbed as high as 50°C for roughly six hours. By morning, stores were throwing away meat, dairy, frozen meals and vegetables. Then, on November 1–2, it happened again, this time across several other European countries. Here is how software can end up cooking food, and what it means for anyone who runs a business with internet-connected equipment.
What Actually Happened
Attackers gained remote control of the refrigeration management systems at French supermarket chains, including Intermarché and Carrefour. The systems were pushed into a continuous defrost cycle with the food still inside. The result was spoiled stock on a very large scale.
| When | What happened |
|---|---|
| August 2026 | Security firm Claroty’s research team (Team82) publishes a report on a hidden login weakness in Danfoss refrigeration controllers. Danfoss releases a patch shortly afterwards and urges customers to install it. |
| Oct 11–12 | Controllers at hundreds of French supermarkets are forced into defrost for about six hours, with temperatures reaching up to 50°C. |
| Oct 12 | France’s CERT-FR publishes an alert about compromised Danfoss AK-SM and AK-SC controllers and tells operators to disconnect them or restrict access. |
| Nov 1–2 | A second wave hits dozens of stores in Belgium, Luxembourg, Sweden, Ireland and Estonia, including Delhaize, Carrefour Belgium, Spar, ICA, Coop and SuperValu. |
How big was it? The numbers differ depending on who is counting. Intermarché’s parent company said around 150 of its stores were caught up, AFP counted at least 300 Intermarché and Netto stores, and Carrefour said about 80 of its supermarkets were affected. Some tallies put the total as high as 700 stores. Estimates of the financial damage run to tens of millions of euros. In the second wave, Delhaize reported around 40 affected stores in Belgium and Luxembourg, and Ireland’s SuperValu said 13 of its 223 stores were hit.
What Is a Refrigeration Controller?
A supermarket does not manage its freezers one by one. A central controller acts as the brain of the whole refrigeration system. It watches temperatures, decides when compressors run, and schedules defrost cycles. To save on staff and travel, these controllers are often connected to the internet so that maintenance companies can check and adjust them remotely.
How Can Software Turn a Freezer Into an Oven?
Every freezer has a defrost cycle. Over time, ice builds up on the cooling coils (called evaporators), and the system briefly warms them to melt it. Normally this is short and carefully limited so the food stays safe.
According to a refrigeration contractor quoted by Al Jazeera, the attackers switched the units’ evaporators into defrost mode and left them there. Reports say they overrode the normal limits on how long and how hot the cycle could run. The cooling equipment became a heater, and the food inside paid the price.
The attackers did not need to break the freezers. They only needed to give a legitimate setting the wrong instructions.
How Did the Attackers Get In?
Here is the honest answer: officials have not publicly confirmed the exact method. Neither French authorities nor Danfoss has said who carried out the attack. What reporting and experts do point to is a combination of weaknesses, and none of them is exotic.
Ransomware or Sabotage? Why This Case Is Different
Most cyberattacks you read about lock files or steal data and then demand money. So far, no one has claimed responsibility for the refrigeration attacks, and reporting describes them as sabotage rather than ransom. That could change as investigations continue.
What makes the case stand out is the physical result. Attacks on everyday internet-connected devices, often called the Internet of Things (IoT), can now cause real-world damage: spoiled food, lost sales and empty shelves. The second wave also shows this was not a one-off. Reports say it appears to follow the same method, although investigators have not yet confirmed that.
🇵🇰 What Pakistani Businesses Can Learn
You do not need to run a French supermarket for this to apply. Cold storage warehouses, restaurants, bakeries, pharmacies keeping medicines cool, dairy and meat suppliers, and malls with smart building systems all depend on equipment that may be connected to the internet and managed by an outside contractor.
The lesson is simple: if a device can be reached from the internet and nobody is responsible for updating it, it is a risk. Ask your contractors directly which of your devices are online, who can log in remotely, and when the software was last updated.
What Businesses Can Do Right Now
1. Find out what is connected. Make a list of every controller, camera, sensor and building system that connects to a network, including ones installed by contractors.
2. Take devices off the public internet. France’s CERT-FR told operators to disconnect affected controllers or filter access to them. If remote access is needed, put it behind a VPN or an approved list of addresses, not an open web page.
3. Install updates. Ask the manufacturer or your maintenance company for the latest firmware and confirm in writing that it has been applied.
4. Replace end-of-life equipment. If a device no longer receives security updates, the only real fix is to replace it, or at minimum isolate it from the internet.
5. Secure the logins. Change factory passwords, use a unique strong password for each device, and remove accounts that are no longer needed.
6. Keep an independent backup alarm. A simple battery-powered temperature logger or alarm that does not rely on the main controller can warn staff in time to move stock. Have a written plan for what to do when the cold chain fails.
The Bottom Line
The French freezer hacks show how little it can take to turn a software weakness into a physical loss. The attackers did not need advanced tools against a locked-down system. By most accounts, they found devices that were reachable, out of date, and managed by several different parties.
As of November 3, investigations are still under way, and details may change. If your business relies on connected equipment, the best time to ask who controls it and how it is updated is before something goes wrong.
Sources and further reading: reporting by Bloomberg (via Quartz), Reuters, The Hacker News, The Register, CBC and Supermarket News; CERT-FR alert of October 12; Claroty Team82 research. This article reflects information available on November 3, 2026.