Supermarket Fridges Hacked: How Freezers Were Set to 50C

The supermarket fridges hacked in France were a real attack: overnight on October 11 to 12, 2026, attackers reached internet-facing refrigeration controllers in French stores and, according to Security Affairs, apparently forced fridges and freezers into a continuous defrost set to 50 degrees (122F). Finance Minister Roland Lescure put the toll at about 700 of France's roughly 10,000 supermarkets, SecurityWeek reports. CERT-FR gives no store counts, so that figure is a single secondary report.

A second wave followed in early November across six more countries, and on November 2 the same style of attack targeted the cold storage serving three French blood-plasma sites. France's national cyber response team, CERT-FR, confirmed the core of it in alert CERTFR-2026-ALE-012, published October 12 and last updated October 16: the remote controllers of refrigeration installations were targeted, and campaigns were "probably still ongoing".

As of November 8, 2026, no official source has said who did it or which software flaw they used. For any store still running one of these boxes, that unknown is the risk.

Supermarket fridges hacked: what happened in France and beyond

The first wave of the supermarket fridge hack in France came overnight on October 11 to 12. Security Affairs reported that Intermarché and Netto (the Mousquetaires group) counted about 300 affected stores, Coopérative U fewer than 100, and E.Leclerc several. Store counts moved as the days passed: SecurityWeek later cited about 150 Intermarché stores with units held at 50C for six hours, Carrefour 80 and Coopérative U 80, while earlier reports had put the national total at 300 to 350.

The losses were concrete. The Intermarché in Haguenau lost its entire frozen stock, about €50,000, and the Leclerc in Wasselonne threw away about €220,000 of fresh and frozen goods. The Paris prosecutor opened an inquiry and said the attacks also caused fires.

The attacks did not stop in France. BleepingComputer reports that more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia were affected in early November. In one Swedish store the system began generating heat; in another the temperature was set to 50C (122F).

Then came the blood supply. On November 2, attackers tried to raise temperature and defrost thresholds at three plasma cold-storage sites run by the French Blood Establishment (EFS), AP reported. EFS says monitoring caught it in time, no blood products or samples were compromised, and collection and distribution continued. EFS also says it was not the direct target: its refrigeration supplier was.

What is a refrigeration controller?

A refrigeration controller is the small computer that runs a store's cooling plant: it holds the temperature settings and the defrost schedule (defrost is a short heating cycle that melts ice off the cooling coils). Many have a web management page so they can be operated remotely, and that page is what the attackers reached.

CERT-FR's list of affected equipment names four product lines: Copeland xweb, Dixell xweb, Danfoss AK-SC series and Danfoss AK-SM series. Security Affairs narrowed the October models to the Danfoss AK-SM800 and AK-SC355, both end of life, and the Danfoss AK-SM 800A running outdated firmware. Per SecurityWeek, AK-SM 800 support ended in May 2021 and the AK-SC 355 was discontinued in 2016.

The login page is the weak point. CERT-FR states plainly that exposing a management interface to the internet goes against good practice. Yet on October 11, the internet-scanning service Censys counted nearly 3,000 internet-exposed Danfoss StoreView panels (StoreView is the web interface on these controllers), over 1,800 of them in France. Anyone running the same kind of scan can find those open doors, the same pattern our explainer on what botnets are traces through 1.3 million hijacked TV boxes.

How did hackers heat supermarket fridges?

The attackers heated the fridges by turning the defrost function against the cooling units. According to Security Affairs, the attackers apparently triggered forced defrost in continuous mode with a 50-degree setting, so the heaters that normally run briefly kept running for hours. Le Monde reported, via SecurityWeek, that defrost cycles were stretched from one hour to as many as eight, which delayed alarms.

How they got in is the open question. CERT-FR does not name the exploited vulnerability. There is a documented candidate, though. In May 2025, CISA advisory ICSA-25-140-03 listed three CVEs in the Danfoss AK-SM 800A series:

• CVE-2025-41450, improper authentication (the login check can be bypassed), severity 8.2 out of 10, fixed in firmware (the software built into the device) version R4.2.
• CVE-2025-41451, command injection (an attacker makes the device run commands it should not), 7.6, fixed in R4.3.1.
• CVE-2025-41452, a configuration injection that can cause denial of service (knocking the service offline), 5.4, fixed in R4.3.1.

If those labels are new to you, our guide to reading a Linux kernel vulnerability CVE explains what a CVE number and its score do and do not tell you. At the time, CISA noted high attack complexity and no known public exploitation.

On August 9, 2026, Claroty's Team82 described the login flaw in plain terms: a hidden "code-of-the-day" path whose password is derived only from the device's current date. Anyone who reproduces the algorithm gets admin access for any day. Claroty did not publish the algorithm and its write-up describes no defrost or temperature effect. It found 2,765 exposed Danfoss AK-SM 800A devices.

Belgian company Sabcobel said the attackers used the same vulnerability in November as in October. BleepingComputer says it is unconfirmed whether CVE-2025-41450 or 41451 are being exploited. The date-based password is the best-documented way in, and it remains unconfirmed. A remote login left facing the internet is the same lesson our post on the OpenSSH vulnerability 2026 draws for servers.

What we checked: the timeline from warning to attack

This is a SyntaxRadar calculation built from the dates and counts in the sources above. Our arithmetic, not a source claim, is in the right-hand column.

Two caveats. First, no official source links the attack to the 2025 CVEs, so the 510 and 412 day gaps show how long a documented fix existed. They do not prove it would have stopped this attack. Second, the older AK-SM 800 and AK-SC 355 are end of life: at attack night the AK-SM 800 had been out of support for about five years and five months, so for those boxes there may be no firmware fix to install at all.

Exposure fell in the days after the alert, but not to zero. Cybersecurity Dive also cites Shadowserver counting 1,173 exposed Copeland XWEB Pro and Evo instances, and SecurityScorecard counting more than 5,200 StoreView instances across more than 4,600 public IP addresses. These are different scans on different dates, so they are not directly comparable.

The cost figures are scattered. The two Alsace stores above lost €270,000 between them (€50,000 plus €220,000, which matches SecurityWeek's combined figure). That is two hand-picked examples, not an average for 700 stores. Separately, Ahold Delhaize expects fourth-quarter sales to be cut by up to €250 million ($281 million) and operating income by up to €100 million; AP links that to the fridge attacks, while the company itself blamed "malicious actions by others".

Is my smart fridge safe from hackers?

No source we opened reports a home smart fridge being hit. Every device CERT-FR lists is commercial refrigeration equipment: controllers that run the cooling plant of a store or a cold-storage site.

So can hackers hack a fridge? Yes, if the fridge has a reachable login and an unpatched flaw, because at that point it is a computer with a cooling system attached. The supermarket case shows the conditions that made it possible: a management page facing the open internet, and old or end-of-life firmware. As general good practice rather than anything these sources say, the same checks apply at home: keep connected devices updated, change default passwords and do not open them to the internet.

None of the sources we opened ties AI tooling to these attacks. For background on how attackers use AI to scale up elsewhere, see our report on AI for hacking, which is separate from the fridge facts above.

What should operators do when supermarket refrigerators are hacked?

CERT-FR's checklist for operators is short and specific:

• Remove the controller from the internet entirely.
• Review the whole configuration, including defrost schedules, not just passwords.
• Restore remote access only through a secure VPN or protected network. IP filtering is only an emergency step.
• Update the firmware, set the Danfoss security level to Strict and change default passwords.
• If a unit was compromised, restart or factory-reset it, then reconfigure it. A factory reset alone is not enough, because the device stays vulnerable.

Claroty's advice for the Danfoss AK-SM 800A matches: upgrade to R4.3.1 or later and keep the device on a trusted network only. Google Threat Intelligence's John Hultquist, quoted by Cybersecurity Dive, argued this supply chain should be treated as critical infrastructure.

The supplier side is still murky. Press reports name Coolworld as the blood service's refrigeration provider; EFS itself has not named it. Coolworld told BleepingComputer it is aware of an incident involving remote monitoring software, that only a limited number of units were affected, and that the cause was a vulnerability in a third-party component outside its direct control. Copeland said it is working with affected customers.

Supermarket fridges hacked: what to watch next

Three things will settle the open questions. First, whether CERT-FR, Danfoss or the Paris prosecutor names the exploited flaw: as of November 8, 2026, none has. Second, attribution: no group has claimed the attacks in any source we opened. Third, the exposure counts: if the Shadowserver and Censys numbers keep falling, the pool of reachable controllers shrinks, and if they stall, CERT-FR's warning that campaigns are probably ongoing still stands. The contested 110C setpoint (the target temperature, not a reading) at the blood-plasma sites (Le Canard Enchaîné's figure, which a French outlet says was a value sent to the machine, not a temperature reached) is the other detail to watch for an official account.