French Supermarket Freezer Hacks Hit Hundreds of Stores

On the night of 11 October 2026, an unknown attacker reportedly compromised refrigeration controls used by hundreds of French supermarkets, triggering extended defrost cycles in refrigerators and freezers across the country. The incident disrupted thousands of units, reportedly causing millions of euros in damage across around 700 stores in France, spoiling food, damaging equipment, and even reportedly starting some fires.

The technology involved included Danfoss refrigeration controllers, as well as Dixell and Copeland XWEB systems. It remains unclear how the intruder gained access to these systems, but the Danfoss controllers central to the campaign ran Internet-accessible Web servers and were often reached with default credentials: admin as the username and the current date as the password.

CERT-FR issued several recommendations to affected supermarkets, such as changing default passwords, factory resetting compromised equipment, and updating firmware; Danfoss has said many attacks involved legacy products that no longer receive updates.

Experts emphasise that a shared refrigeration infrastructure created a cascade effect across hundreds of stores. SentinelLabs’ Chris St. Meyers notes that CERT-FR confirmed the compromises involved Danfoss AK-SM and AK-SC controllers, along with Copeland and Dixell XWEB systems, technologies deployed widely in retail environments with similar remote-access configurations.

Tributech’s Thomas Plank likewise attributes the spread to a common exposure model: remote-management controllers exposed to the Internet, often on out-of-support firmware, maintained by a small pool of contractors. The piece highlights that other European stores experienced similar fridge-and-freezer attacks in early November, with related incidents affecting blood banks in France before being contained.

Threat researchers such as Sophos’ Rafe Pilling describe this as a warning to retailers that industrial systems must not be Internet-accessible and should be secured to prevent similar disruption.