What happened
Overnight on 11 to 12 October 2026, attackers reached the supervisory controllers that run supermarket fridges and freezers and forced them into a continuous defrost cycle at 50 °C. Stores opened to spoiled stock, and several reported fires. Intermarché said about 150 of its stores were affected for around six hours, Carrefour reported 80, and the French government later put the total at about 700 supermarkets.
Two stores in Haguenau were reported to have lost about €270,000 between them. France's cyber agency, CERT-FR, named controllers from Danfoss, Copeland and Dixell, and warned that attacks were probably still under way.
~700
50 °C
1,100+
Why it isn't only a French problem
The controllers were not hacked through some exotic flaw. Most were reachable directly from the internet so that refrigeration contractors could service them remotely, and many were old models no longer receiving security updates.
On the day of the attack, researchers counted 2,752 internet-exposed controllers of one brand, 1,590 of them in France. The rest were elsewhere, including the UK and the US. Earlier research had also shown that a compromised controller could stop cooling while still showing staff a normal temperature.
The same pattern applies to heating, ventilation and building management systems: networked, remotely serviced, rarely updated, and trusted without an independent check.
Five checks for any building
Can any controller be reached from the internet?
Ask your contractors and IT team for a list of every controller with a public address. If the answer is "we're not sure", that's the answer.
Who has remote access today?
List every account and route: contractor portals, VPNs, vendor cloud services. Remove former contractors and shared logins. Remote access should run through a secure connection, not an open web page.
Are passwords and firmware current?
Default passwords should be gone. Firmware should be on a supported version, and devices past end of life should be isolated or replaced.
Is anything checking the system independently?
If the only temperature reading comes from the controller, a tampered controller can hide the problem. Simple independent sensors in key cases or rooms give you a second opinion.
Who gets the alarm at 3 a.m.?
The French attack ran overnight. Check that alarms reach a person who can act, and that someone is told when a setpoint or defrost schedule changes.
One practical note from CERT-FR: check your service and insurance contracts before cutting a contractor's connection, then restore access only through a secure route.
Want these checks done for you?
Our fixed-price Refrigeration Controls Security Check covers all five, across every site, in 2 to 3 weeks.