2026 French supermarket refrigerator hack
From Wikipedia, the free encyclopedia
On 11 October 2026, an unknown party hacked into the refrigeration controllers at up to 700 French supermarkets[2] and set them to defrost mode overnight, causing their refrigerators to overheat. The cold chain disruption forced supermarkets to discard vast stocks of spoiled goods, resulting in losses estimated to total tens of millions of euros.[3][4]
| Date | 11 October 2026 |
|---|---|
| Type | Cyberattack |
| Target | Supermarket refrigerators, mainly in France |
| Perpetrator | Unknown |
| Outcome | Discard of vast stocks of spoiled goods |
Property damage | €10 million+ (estimated)[1] |
The affected refrigeration controllers each ran a web server reachable over the public internet, many of them[2] with login credentials 'admin' as the username and the current date as the password.
The hack was unprecedented, being the first cyberattack to have a physical effect on a nation's food supply chain.[5] Various disruptions in the groceries sector have since occurred in the Netherlands, Belgium, and to some extent in the United States[6][7]
Hack
On the night of 11 October 2026, over 300 Intermarché and Netto stores, 80 Coopérative U,[2] 80 Carrefour stores, around 30 Monoprix stores, several E.Leclerc stores, and others were struck in an large-scale cyberattack.[8] The supermarkets' refrigeration systems were compromised and instructed to enter an unusual defrost cycle with their contents still inside. The hack went unnoticed as it did not activate alarms and many employees were not present at the time to stop it. Refrigerators overheated due to the continuous defrosting, with many climbing up to 50°C (122°F) after six hours. One supermarket in Normandy reported some of its refrigerators had reached 80 °C (176 °F).[2] Furthermore, at some supermarkets the intense heat caused refrigeration equipment to catch fire or even melt;[9][10][11] water damage from fire sprinkler systems also occurred.[2] Across France, whole aisles of refrigerated produce and frozen goods were ruined and had to be disposed of due to food safety concerns.[11] One Intermarché supermarket in Issy-les-Moulineaux alone disposed of several tons of food.[2]
BFM TV initially reported that some locations could face losses in the tens of thousands; two outlets in Alsace alone reported a combined loss of €270,000. The total damage is anticipated to amount to tens of millions of euros.[12][13][14]
Investigation and analyses
Prime Minister of France Sébastien Lecornu instructed the Agence nationale de la sécurité des systèmes d'information (ANSSI) to investigate the cyberattack and coordinate with other European countries to prevent further hacks.[9] Investigators identified AK‑SM800 and AK‑SC355 refrigerator regulator systems by Danish manufacturer Danfoss to be the attack surface. Other controllers found to be affected were Copeland XWEB and Dixell XWEB by Copeland.[15] AK‑SC355 had reached end-of-life in 2016 and AK‑SM800 in May 2021, and were no longer supported with updates.[16][17] Danfoss had previously advised replacing both of the deprecated models with new ones.[10]
In 2025, cybersecurity firm Claroty's Team 82 found multiple vulnerabilities within Danfoss control systems. The refrigerator controllers had a publicly reachable web server with a login screen that could be accessed with the username 'admin' and a hidden "code of the day" function that allowed users to bypass the password by inputting the device's date in its place.[18][19] Danfoss disclosed Claroty's findings on 24 March 2025 and began their own investigation.[20] In August 2025, Danfoss issued a software release 4.3.1 to their AK‑SM800A series of models which patched the vulnerabilities.[21] AK-SM800A models were unaffected by the hack, except those which had not been updated with R4.3.1.[22]
Investigations found the same vulnerabilities within supermarkets throughout Europe, including Belgium, Germany, Luxembourg, the Netherlands,[23] Portugal, Poland, and Spain.[9][10][1] Chains in Belgium and the Netherlands reported various IT disruptions of websites, distribution centers, and other critical operations. In the U.S., the Dutch Ahold Delhaize chains Stop & Shop and Food Lion reported IT disruptions and took some systems offline, though not as comprehensively as France.[6]
The Food Protection and Defense Institute of the University of Minnesota noted of legacy systems that "Many ICSs used in the food industry are quite old, highly customized, and were not designed with security in place or with the ability to be made secure through updating."[6] Ken Munro of Pen Test Partners noted that the culprits could have been "kids messing around," due to ease of the exploit;[14] state actors such as Iran and Russia also posses the capability, cybernetic sabotage being a known standard method of operation.[2]
Reactions
European Commissioner for Agriculture and Food Christophe Hansen commented on the attack, saying that "Food security requires more attention at all levels" and that the "exploitation of food has become a reality."[10]
Coopérative U CEO Dominique Schelcher described the cyberattack as "unprecedented", "unacceptable," and "extremely serious".[5]
