When the term "cyberattack" is mentioned, most people picture stolen credit card numbers, corporate hard drives encrypted with ransom demands in Bitcoin, or leaked sensitive emails from government officials. However, the events that struck the French retail sector in October 2026 clearly demonstrated that we are not far from a reality where hacker rampages do not end in cyberspace but have very tangible and destructive consequences right on our store shelves.
On the night of October 11–12, 2026, an unprecedented incident occurred in France. Unknown attackers gained remote access to the control units of refrigeration and freezer systems in hundreds of supermarkets. The primary chains affected were giants such as Intermarché (with at least 150 stores confirmed affected) and Coopérative U (nearly 100 stores), while reports of issues also emerged from some branches of the E.Leclerc brand.
Instead of simply shutting down the systems, the attackers chose a far more insidious method. They exploited a service mode known as "defrost." They remotely altered configuration parameters to trigger irregular or continuous defrosting cycles in the cooling circuits.
On the control panels of the affected units, target temperatures were set as high as 50°C. Consequently, actual temperatures inside the freezers and refrigerated display cases rose unchecked to as much as 36°C overnight.When store employees arrived for work in the morning, they were met with a shock. The cold chain had been irreversibly broken. Tons of fresh meat, dairy products, frozen goods, and ready-made meals had to be immediately discarded for safety and hygiene reasons. Direct losses—comprising the value of the spoiled goods and lost profits—run into the millions of euros, and the Paris public prosecutor's office has already launched an official investigation into the incident.
At the heart of the affected refrigeration circuits were control units from the renowned manufacturer Danfoss. Specifically, these were system managers from the AK-SM800 and AK-SC355 series, as well as the newer AK-SM800A model. These units serve as the central brains of commercial refrigeration systems: they monitor temperatures, control compressors, initiate maintenance cycles, and often transmit alerts to service technicians via the internet.
According to initial information from security experts, the vulnerability lay primarily in outdated or unpatched firmware. Many of these devices were left exposed to the public internet without adequate security, using default login credentials or unencrypted remote management protocols. Attackers simply had to locate an unprotected interface, log in using known vulnerabilities, and send a command to disable cooling—setting an extremely high target temperature.
For years, a myth prevailed that cybersecurity was a discipline reserved for the financial sector, cryptocurrency exchanges, fintech companies, insurers, or tech firms. This incident has starkly demonstrated just how mistaken that belief is.
We live in an era where software does not merely manage virtual data but directly influences the physical world. It powers:
The impact of a coding error or an insecure port in these systems goes far beyond the loss of financial data. It can result in food spoilage, the disruption of critical supplies, damage to expensive machinery, and—in the worst-case scenario—threats to human life. Internet of Things (IoT) and operational technology (OT) devices are becoming primary targets for attacks precisely because their security is often neglected.
If software controls your company's key processes, it must be treated with the same level of rigor as accounting systems or banking applications. A case from France offers a crucial lesson for all infrastructure administrators. What measures are essential today?
The attack on French supermarkets serves as a wake-up call for the entire industry. Cybersecurity is simply no longer just about passwords and antivirus software—it is about maintaining the continuity of the entire company's operations.