How Did Hackers Heat French Supermarket Fridges to 50 °C?

What happened in French supermarkets?

Overnight from the eleventh to the twelfth of October, twenty twenty-six, attackers took remote control of the refrigeration systems in French supermarkets. They forced refrigerated and frozen cases into defrost, and some were reported as high as fifty degrees Celsius. Stores threw away fresh and frozen food, and the Paris prosecutor's office reported fires.

This was not an attack on fridges in people's homes. It targeted the commercial controllers that run a whole store's cooling. France's national cyber alert team, CERT-FR, issued an alert the same day.

What did the attackers change?

Every commercial freezer runs a defrost cycle. It is a short, normal heating phase that melts ice off the cooling coils. The attackers abused that feature.

According to BFM-TV, as reported by the Associated Press, they forced a continuous defrost with temperatures set as high as fifty degrees Celsius. The group that owns Intermarché told Reuters its cases were heated to fifty degrees for six hours. European rules require quick-frozen food to stay at minus eighteen degrees or colder.

After hours of heat, that food could not be sold, and the group said it threw all of it away to avoid any health risk.

How did the attackers get in?

The exact entry point has not been made public. Here is what is known. The affected controllers, from Danfoss, and later Copeland and Dixell, have a web management page so refrigeration contractors can work on them remotely.

Many of those pages were reachable from the public internet. Danfoss said most of the systems hit were older products that no longer received security updates, and some newer units were running outdated firmware. Security flaws in a newer Danfoss model were disclosed and patched in twenty twenty-five, but no authority has said they were used here.

As of October eighteenth, no group has claimed the attack, and there has been no ransom demand.

How many stores were hit?

The count depends on who is counting. France's Finance Minister told Parliament that about seven hundred of the country's ten thousand supermarkets were affected. Coopérative U said eighty of its stores, and Carrefour said eighty.

The group that owns Intermarché gave about one hundred fifty stores to Reuters and three hundred to the Associated Press. On October eleventh, the scanning firm Censys counted one thousand eight hundred twenty-five Danfoss control panels exposed on the internet in France. By October fourteenth, that number had dropped to five hundred thirty-seven, as operators took them offline.

What did France's cyber agency tell businesses to do?

CERT-FR's advice is direct. Take these controllers off the public internet. Reach them only through a secure VPN or a protected network.

Update the firmware, turn on the vendor's strict security mode, and change every default password. Review the whole configuration, including the defrost schedules. And if a unit is end-of-life, a factory reset is not enough.

Left exposed, it will most likely be compromised again. The agency also warned that the attacks are probably still going on.

Could this happen to your business?

Any business with equipment that has its own web page carries the same risk. That includes building controls, HVAC, cameras, door access, and refrigeration. The defense is the same every time.

Know every connected device on your network. Keep management pages off the public internet, behind a firewall, with VPN-only access. Change default passwords, and replace equipment before it reaches end-of-life.

When a contractor needs remote access, it goes through that same controlled path, never an open port. At Triton, Sophos firewalls are the non-negotiable perimeter standard. A secure infrastructure is not set once and forgotten.

Triton proves it with penetration testing and intrusion testing, so the open doors are found and closed before an attacker finds them.