Sometime during the night of October 12, 2026, attackers gained remote access to internet-connected refrigeration systems in more than 500 French supermarkets and cranked temperatures to 50°C. By morning, tonnes of perishable food were destroyed, equipment had melted, and in some cases fires had broken out. E-Leclerc, Intermarché, Carrefour, Monoprix, and Coopérative U all confirmed they were hit. The vector was not sophisticated social engineering or zero-day exploits — it was unsecured industrial IoT hardware running outdated firmware. The refrigeration systems were manufactured by Danish company Danfoss, specifically the AK-SM800 and AK-SC355 controllers. Danfoss told AFP that most affected units were "legacy" products with "outdated firmware" and that the company had previously advised supermarkets to update them. France's cybersecurity agency ANSSI has since told companies to disconnect the affected models from the internet or restrict access immediately. The attackers reportedly exploited a forced defrosting function built into the systems — a feature designed for maintenance, weaponized because nobody locked the door. The damage distribution tells a story of concentration risk. Intermarché lost at least 300 stores plus its Netto brand. Coopérative U confirmed more than 100 affected supermarkets. Carrefour reported 80, and Monoprix roughly 5 percent of its 490 locations. The financial toll is still being calculated but runs into millions of euros in destroyed inventory alone, before accounting for equipment damage, fire remediation, and lost sales. Officials are now liaising with other European countries that may share the same vulnerability. This is not an isolated phenomenon. In April 2025, Marks & Spencer suffered a ransomware attack that cost approximately £300 million ($397 million) after hackers from Scattered Spider using DragonForce ransomware forced the company to suspend online orders. The same group targeted Co-op and Harrods. In June 2025, United Natural Foods — supplier to Whole Foods — was forced offline by a cyberattack. In November 2025, Ahold Delhaize USA saw operations disrupted across more than 2,000 stores including Hannaford, Food Lion, and Stop & Shop. The pattern is structural, not incidental. As food systems digitize, every internet-connected compressor, thermostat, and inventory system becomes an attack surface. The French attack is notable because it targeted the physical layer — not data, not payment systems, but the actual temperature of food — turning a maintenance feature into a weapon. Cybersecurity analyst Steven Lachance told Al Jazeera that the same logic applies to medical and energy systems: anything connected to the internet and left unpatched is a live target. The political timing is loaded. President Macron ordered last month that France's critical infrastructure be protected from Russian "hybrid attacks." Investigators have not attributed the supermarket hack, but the context is impossible to ignore: an attack on food infrastructure during a period of heightened geopolitical tension, targeting a supply chain chokepoint that affects millions of consumers. Whether state-sponsored or criminal, the effect is the same — demonstrating that civilian food systems are soft targets. The core lesson is not about refrigerators. It is about the systemic decision to connect critical physical infrastructure to the internet without mandating security updates, without requiring network segmentation, and without treating food cold-chain as critical infrastructure. Danfoss warned retailers. Retailers did not act. The cost was externalized to consumers and supply chains. This will happen again, to different systems, until the incentive structure changes.
