MediumII Cyber Warfare & Critical Infrastructure12 October 2026, Monday
Hackers heat refrigerators in hundreds of French supermarkets to 50°C
On the night of 11 October, display cases at French chains running older Danfoss refrigeration controllers were remotely locked into a continuous defrost cycle. Losses at just two stores in Alsace come to 270,000 euros, and the Paris prosecutor has opened an investigation.
The attack began on the evening of Sunday 11 October and was discovered on the morning of 12 October, when staff opened the cabinets. According to a Beinsure round-up, refrigeration failed at about 150 Intermarché stores, more than 100 Coopérative U stores, 80 of Carrefour's 6,000 stores and about 5% of Monoprix's 400-plus outlets. Les Mousquetaires said some systems reached 50°C for around 6 hours. The Paris prosecutor has launched an investigation into a large-scale attack, and fire reports are part of the file.
The target was not tills or customer data but the stores' remotely managed refrigeration controllers. According to UPI, the cabinets were set to about 49°C and held there. Danfoss said the affected devices were AK-SM and AK-SC series models running older software. Glitchwire reports that Claroty's Team82 demonstrated at DEF CON 34 in August 2026 a hidden mechanism that bypasses authentication on the AK-SM 800A controller, along with a flaw allowing remote code execution. Danfoss closed both in version R4.3.1.
As of 12 October no perpetrator had been named and no ransom note reported; the attack appears destructive. On 12 October Prime Minister Lecornu asked the cyber security agency ANSSI to coordinate the investigation with European bodies, and EU Agriculture Commissioner Hansen described the incident the same day as the weaponisation of food. Total losses nationwide are estimated only at 'several million euros'; no precise figure could be verified.
Talay assessment
Bottom line
The attack shows Europe's cyber debate moving from data theft to physical damage. The flaw had been described publicly at DEF CON two months earlier and a patch existed; the real constraint is that old controllers in thousands of stores remain exposed to the internet. Until a perpetrator is named the incident stays outside the hybrid-threat file, but Paris's call for EU coordination pushes it in that direction.
Likely effects
- Food retailNegativeWeeks
Cold-chain goods were destroyed in hundreds of affected stores, with losses of 270,000 euros at two Alsace outlets alone. Chains will have to invest further in replacing controllers.
- Cyber insuranceNegative1–6 months
A destructive attack with no ransom and real physical damage reopens the debate over war and state-actor exclusions in insurers' operational technology cover.
- EU regulationUncertain1–6 months
Hansen's emphasis on food security adds pressure to extend rules that make patching of legacy industrial devices mandatory to the food chain.
Possibilities, ranked
- 1Perpetrator unnamed, focus shifts to patching55%
An ANSSI technical report highlights the flaw and the outdated software, chains update their controllers, and no political attribution is made.
Watch: An ANSSI or CERT-FR advisory on Danfoss AK-SM devices
- 2Attack attributed to a pro-Russian group30%
Paris names a culprit or a group claims responsibility, and the case moves into the EU's hybrid-threat sanctions regime.
Watch: A formal attribution from the Paris prosecutor or the Élysée
- 3Attack spreads to other countries15%
Similar outages are reported in Belgium, Spain or Germany, where the same controllers are in use.
Watch: Reports of store outages involving Danfoss controllers in another EU country
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Loss at two Alsace stores▼ €270,000
- Carrefour stores affected▼ 80 / 6,000