What this covers:
Attackers reached into the cooling systems of hundreds of supermarkets in France overnight into Monday, October 12, and told the equipment to heat up. The supermarket fridge hack pushed cold units as high as 50°C (122°F) and held them there for about six hours, as reported by the BBC and ABC News.
Food was thrown out, fridge aisles were closed, and in some stores the heat started small fires. French prosecutors opened a cyber-crime investigation, and one chain disconnected another 100 stores from the internet to stop the same thing happening to them.
No group has claimed the supermarket fridge hack, and authorities have not said how the attackers got in. That gap is what makes the lesson here a general one, not a technical post-mortem.
Here is what is confirmed, what is still unknown, and what any business running connected equipment should take from it.
What the supermarket fridge hack Did
Supermarkets let their freezers warm slightly overnight in a short defrost cycle, usually measured in minutes. The attackers took control of the software that regulates those temperatures and switched the units into defrost and kept them hot, the BBC reported.
Les Mousquetaires, which owns Intermarché and Netto, said fridges at around 150 to 180 of its stores sat at 50°C for six hours. Staff discarded every affected product to remove the health risk.
Carrefour said 80 of its stores were hit. Monoprix reported roughly 5% of its locations, and Coopérative U said more than 100 of its supermarkets were targeted.
The chain figures put the total near 400 stores out of roughly 15,000 in France, though the counts disagree between outlets and the full scale is still unclear. French broadcaster BFMTV showed a freezer in an ice cream aisle reading 26.5°C.
Who Was Hit and What It Cost
Fresh and frozen stock is the product. When it cannot be sold, the loss lands the same day.
Les Mousquetaires told CNBC it expected “several million euros in losses” across the roughly 180 affected stores. Two supermarkets in the Alsace region alone reported EUR 270,000 (about $290,000) in combined losses, per the BBC, which is how a national total reaches the millions.
The supermarket fridge hack crossed borders. Felix Aime, a senior threat intelligence analyst at Sekoia, told Reuters that retailers in Spain, Portugal, Poland, Germany and Belgium were also affected, with the Netherlands added by SecurityWeek.
European Commissioner for Agriculture and Food Christophe Hansen condemned the attack and wrote that “food security requires more attention at all levels. Because the weaponization of food has become a reality.”
The French retail association asked the software supplier for “full transparency.” EuroCommerce director-general Christel Delberghe said the incident “underlines the importance of resilience across the entire supply chain.”
Dealing with this at your office? Talk to a local IT expert →
Why the supermarket fridge hack Worked
The affected retailers used refrigeration controllers made by Danfoss, a Danish manufacturer, and that software is designed to let staff manage cold units remotely. That remote path is the feature and the risk.
Danfoss said the units involved were older models whose security software could not be updated to address a risk the company had already identified. It said it has “long advised” customers to keep supported systems current.
Prior research points at how a controller can fall. Analysts at Claroty found a hidden authentication mechanism in one Danfoss controller platform.
The flaw accepted a code generated from the device’s own date, which bypassed the administrator password. It was patched in August 2025, and experts described it as easy to script.
Here is the part that matters for accuracy. The Register reports that authorities have not identified the entry point. They have not confirmed that this or any previously disclosed flaw was used in these attacks.
France’s cybersecurity agency ANSSI said systems from Copeland and Dixell were also hit. Copeland declined to confirm and said its priority is protecting customer operations.
The uncomfortable lesson sits in the nature of the device. A temperature setpoint change is a legitimate command. Nothing about it looks like malware, no endpoint tool inspects it, and a controller with a vendor cloud path is reachable from anywhere.
5 Lessons From the supermarket fridge hack
1. Inventory the equipment nobody calls IT. Walk-in coolers, HVAC units, cameras, badge readers, sensors, signage and phone systems are computers with network access. If your list starts and ends with laptops, that is the gap, and our guide to connected device inventory covers how to close it.
2. Put that equipment on its own network. A refrigeration controller has no reason to reach your file server or your accounting system. Separate the equipment network, then restrict what it can reach on the internet.
3. Track firmware with a date, not a hope. Danfoss said the units ran outdated firmware. A per-device list showing current version, support status and last update turns an unknown into a decision.
4. Alert on configuration changes, not just malware. A setpoint or schedule change outside normal hours is the signal here. Six hours of rising temperature is a six-hour window you can page somebody inside.
5. Rehearse manual control. Know how to take a compromised controller offline without shutting the building, who monitors conditions by hand overnight, and who calls the insurer. The same continuity thinking in why production stops matter most applies to a store, a kitchen or a server room.
Most businesses that depend on connected equipment are one unpatched controller away from a costly version of the supermarket fridge hack that never makes headlines.
supermarket fridge hack FAQ
Was the supermarket fridge hack ransomware? No ransom demand has been reported and no group has claimed it. As reported, this is disruption rather than extortion, though that can change as the investigation continues.
What does “defrost mode” have to do with it? Defrost is a normal, short warm-up cycle. The attackers abused the legitimate remote control for it and simply told unit after unit to stay hot instead of returning to temperature.
Were only supermarkets affected? That is where the damage has been documented in France, with reports of retailers hit in Belgium, Germany, the Netherlands, Poland, Portugal and Spain. Any business with remotely managed cooling or HVAC runs the same class of equipment.
Does this apply to a server room or a small shop? Yes. The pattern is old firmware, remote management and no separation, and none of that is specific to grocery retail. That is why we treat it as an operations problem, not a retail story.
What should we check this week? List every connected device, confirm which network each one sits on, note its firmware version, and make sure someone would be alerted if its settings changed at 2am. If you want that reviewed, our cybersecurity services page covers what a proper review includes.
Sources: BBC; ABC News (Reuters); The Register; CNBC. Store counts and losses are as reported by those outlets and by the retail chains; no attacker has been identified.
Not sure what is managing the temperature in your building? Contact Nextek IT and we will inventory the connected equipment on your network and tell you which parts of it are exposed.