Most cyber attacks you hear about steal data or lock up computers. This one went after something much more physical: the fridges and freezers in French supermarkets. There’s no sign so far that it was about stealing data: the attackers changed a setting, and the food spoiled. Here’s what has been reported so far, and what it means for the connected kit in UK small businesses and charities, with no daft jargon.
What happened?
Overnight on Sunday 11 October, attackers remotely reached refrigeration control systems made by Danish manufacturer Danfoss in supermarkets across France (BFMTV). They abused the automatic defrost function, which normally runs for about two hours a day, and turned it into a continuous, forced defrost with the temperature set to 50°C (Tom’s Hardware). One Intermarché in La Haye, Normandy, said in a video that temperatures reached 80°C and melted some of its display cabinets (ICI).
Intermarché told AFP that 150 to 200 of its stores were hit, and Coopérative U (Super U, Hyper U and U Express) said nearly 100 (AFP). France Inter later reported Intermarché’s figure as between 200 and 300 (ICI). E.Leclerc confirmed that “several stores” were affected (franceinfo). Carrefour Market and Monoprix have also been named in reports, but the companies had not confirmed it (AFP).
Coopérative U’s chief executive, Dominique Schelcher, wrote on X: “Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is extremely serious and is unprecedented. It is unacceptable.” (AFP)
Affected stores have to throw away all of their fresh and frozen products (AFP). One Intermarché in Brittany put its own loss at €50,000 (ICI), and two supermarkets in Alsace reported €270,000 between them (BFMTV). Nationally, losses could run into several million euros (Tom’s Hardware). The Paris prosecutor’s office says victims have also reported fires breaking out (AFP).
The cybercrime section of the Paris prosecutor’s office has opened an investigation, handed to France’s anti-cybercrime office (OFAC), to identify the victims and link the attack to the food losses and fires (TF1 Info). The Prime Minister has asked ANSSI, France’s national cyber security agency, to take up the case. His office says the agency has already identified a vulnerability in software supplied by a Danish company and has contacted the supplier (franceinfo).
What Danfoss and the researchers say
In a statement to the press, Danfoss said a limited number of refrigeration management systems in France were affected. It said most were older AK-SM800 and AK-SC355 models that have reached end of life and no longer get security updates, and that the affected AK-SM800A controllers were running out-of-date firmware, even though updates were available. Danfoss says it is working with customers to install updates, strengthen network protection and remove direct internet access where possible (FrenchBreaches).
In August, researchers at Claroty published details of three flaws in Danfoss’s AK-SM 800A controller, including a hidden “code-of-the-day” login that could bypass the normal password, and a flaw that allowed remote code execution. They also found 2,765 of these management screens reachable on the public internet (Claroty). Danfoss fixed the flaws in firmware versions R4.2 and R4.3.1 (CISA). There is no confirmation that those flaws were used in this attack (Euro Weekly News).
What we still don’t know
Who is behind the attack, and exactly how they got in, hasn’t been made public. Danfoss’s statement doesn’t say which weakness was used, and no theft of personal data has been confirmed (FrenchBreaches).
Separately, since Sunday afternoon Albert Heijn, Etos and Gall & Gall in the Netherlands have been dealing with what they call an IT incident. Websites, apps, customer service and home deliveries were switched off as a precaution, electronic shelf labels were still showing last week’s offer prices, and loyalty schemes stopped working (Albert Heijn). Delhaize in Belgium, part of the same Ahold Delhaize group, has also reported disruption (Tom’s Hardware). There is no confirmed link between the Dutch and French incidents (Euro Weekly News).
Why this matters to you: the kit nobody thinks of as IT
You don’t need to run a supermarket chain for this to be relevant. Look round most small businesses and charities and you’ll find kit that is quietly connected: heating and building controls, the CCTV recorder, door entry, tills and card machines, and the fridges and freezers in a café, shop or kitchen. It’s usually put in by a supplier rather than IT, it often keeps the password it shipped with, the engineer gets remote access so they don’t have to drive out, and nobody updates it once it works.
The good news is that the fixes aren’t exotic. They’re the same basics the NCSC recommends for small organisations (NCSC), applied to the boxes in the plant room as well as the laptops.
1. Know what’s connected
You can’t protect what you don’t know about. Walk round and list everything with a network cable, Wi-Fi or a SIM card: heating and air-con controllers, CCTV, door entry and alarm panels, tills and card terminals, and fridge and freezer controllers. Note who installed it, who looks after it, how it connects and whether a supplier can reach it remotely. The NCSC’s guidance on operational technology starts in the same place: keep an accurate, up-to-date record of what you have and how it’s connected (NCSC).
2. Keep it off the internet and away from your office network
Most of this kit doesn’t need to be reachable from the internet at all, and it shouldn’t share a network with the PCs that open your email. Put it on its own separate network (segmentation), so a problem on one side can’t easily spread to the other. Claroty’s advice for the Danfoss controllers was the same: don’t expose management screens to the internet, and limit access to trusted networks or a VPN (Claroty).
3. Lock down supplier remote access
Remote access is how a lot of kit gets fixed quickly, and that’s fine as long as you control it. Each engineer should have their own named login protected by multi-factor authentication (MFA), not a shared account or a password taped inside the cabinet. Use a VPN or remote-access tool you control, switch it on only when it’s needed, and keep a record of who connected and when.
4. Update firmware, change default passwords, retire old kit
Firmware is the software inside a device, and it needs updates like anything else. Change every default password on day one. When a manufacturer says a product has reached end of life, that usually means no more security fixes, so plan a replacement rather than waiting for something to go wrong. Cyber Essentials covers these same controls: firewalls, secure configuration, security updates and controlling who has access (NCSC).
5. Watch for anything odd
Set up alerts that reach a real person: temperature alarms on fridges and freezers, and notifications when someone logs in or a setting changes. Where it matters, a simple independent temperature sensor that texts someone means you’re not relying only on the controller. This attack started overnight, so think about who would notice at 2am.
Have a manual fallback
Plan for the day the clever bit stops working. Who can switch the heating, a fridge or a door to manual, and do they know how? Where are the instructions, and is the supplier’s out-of-hours number written down somewhere that doesn’t need the network? In Dinan, one supermarket moved its fresh and frozen stock into refrigerated lorries and was putting it back on the shelves by the afternoon (ICI). That’s a fallback doing its job.
The insurance angle: don’t assume you’re covered
Intermarché says one of the sticking points will be insurance, warning that its policies don’t “cover this type” of in-store incident (AFP). That’s worth checking for your own organisation. A cyber attack that spoils stock or damages equipment can fall between policies: property cover may exclude cyber events, and some cyber policies focus on data and IT systems rather than physical loss. Ask your broker in writing: if someone remotely tampered with our heating, fridges or door entry, what would we be covered for?
Your connected kit checklist
- List every connected device, who supplies it, who supports it and how it connects.
- Take it off the internet unless there’s a clear need, and put it on its own network.
- Give suppliers named, MFA-protected remote access that you can switch off and review.
- Update firmware, and plan to replace anything that has reached end of life.
- Change every default password, and store the new ones in a password manager.
- Turn on alerts for temperatures, logins and setting changes, and make sure someone sees them.
- Write down the manual fallback for each critical system, with supplier numbers on paper.
- Check your insurance covers cyber-caused stock loss and physical damage.
References
- BFMTV, “« Extrême gravité, inédit et inacceptable » : une cyberattaque frappe les frigos de Leclerc, Intermarché et Super U”, 12 October 2026 (in French)
- Tom’s Hardware, “‘Unprecedented’ cyberattack cripples supermarket fridges across Europe as hackers activate automatic defrosting”, Stephen Warwick, 12 October 2026
- ICI (Radio France), “Une cyberattaque « d’une extrême gravité » vise les frigos des principaux groupes de la grande distribution en France”, Coline Mollard, 12 October 2026 (in French)
- AFP, “French supermarket chains say cyberattack forced refrigerator shutdown”, 12 October 2026
- franceinfo, “Cyberattaque sur des installations frigorifiques : Sébastien Lecornu « suit le dossier personnellement », l’Anssi saisie par Matignon”, 12 October 2026 (in French)
- TF1 Info, “Cyberattaque « inédite » des systèmes réfrigérés : au moins 150 magasins touchés”, 12 October 2026 (in French)
- FrenchBreaches, “Intermarché, Super U, Leclerc : des pirates font grimper la température des frigos à 50 °C”, 12 October 2026 (in French)
- Claroty Team82, “Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers”, Amir Zaltzman, 9 August 2026
- CISA, ICS advisory ICSA-25-140-03, “Danfoss AK-SM 8xxA Series (Update A)”
- Euro Weekly News, “Supermarket cyberattack: Could Spain be next after French food losses?”, Adam Woodward, 12 October 2026
- Albert Heijn, “Mediastatement inzake IT incident”, 12 October 2026 (in Dutch)
- National Cyber Security Centre, “Small organisations guide to cyber security”
- National Cyber Security Centre, “Operational Technology” guidance collection
- National Cyber Security Centre, “Cyber Essentials” overview
Need a hand applying any of this to your business? Get in touch — call +44 1472 564538 or email services@msl.org.uk.