This is Part 7 of Critical Infrastructure at Risk, CommandEleven Intelligence’s series on the systems that keep daily life running. Parts 1 through 6 examined the United States sector by sector. This installment follows the threat across the Atlantic and into the food supply.
Bottom Line Up Front
On the night of October 11, 2026, attackers took remote control of refrigeration controllers in hundreds of French supermarkets, switched freezers and chilled cases into defrost and drove some to 50°C (122°F). France’s finance minister told Parliament that about 700 of the country’s 10,000 supermarkets were affected. Food was thrown out by the truckload, and some equipment caught fire. Reporting based on analysis by the French threat-intelligence firm Sekoia places compromised controllers in Spain, Portugal, Poland, Germany and Belgium as well.
Nobody has claimed the attack, and no government has attributed it. What is already clear is how it was possible: the systems that keep a supermarket’s food cold were reachable from the open internet, many were running firmware their manufacturer stopped supporting years ago, and the flaws in the newer models had been published two months earlier. This is not a France problem. Researchers counted at least 4,500 of one manufacturer’s controllers exposed online the day after the attack, and a strikingly similar overnight “defrost” failure hit US military commissaries in August.
CommandEleven Intelligence estimates direct losses in France alone at roughly €35 million to €120 million in destroyed food and damaged or condemned equipment, before lost sales are counted. The more important number is the one nobody has: how many cold stores, warehouses and distribution centers worldwide are still one login page away from the same outcome.
Key Judgments
KJ1: This was a regional campaign, not a French incident. France took the brunt, but Sekoia’s analysis, reported by Reuters, places affected controllers in five more European countries, and exposure scans show vulnerable systems on several continents. [CONFIRMED on the reported spread; ASSESSED on campaign scope]
KJ2: The root cause is architectural, not a single bug. Refrigeration controllers were placed on the internet to serve outsourced maintenance, food-safety alarms, energy management and cost-cutting, and nobody along that chain owned the security of the connection. [ASSESSED]
KJ3: The August 2026 commissary outages look like a dress rehearsal. The signature (freezers forced into defrost overnight, at multiple sites, on systems linked to an online platform) matches. The Army’s cyber investigators and the Air Force Office of Special Investigations opened inquiries; no cause has been announced. [CONFIRMED on the investigations; SPECULATIVE on a link to France]
KJ4: Attribution is open, and the protests are a poor fit. There is no claim, no ransom note and no reporting connecting the attack to France’s ongoing street protests. The six-country footprint and the technical preparation point away from a domestic protest action. [ASSESSED]
KJ5: The exposure is still live. A day after the attack, at least 4,500 Danfoss management interfaces were still visible online, and the scanning firm Onyphe found only a small minority running current software. [CONFIRMED]
KJ6: The food-security consequence is local but real. France’s food supply was never at national risk. But a single night’s attack emptied fresh and frozen aisles in hundreds of towns, and the same method scaled to distribution centers or cold-storage warehouses would hit far harder. [ASSESSED]
What Happened on October 11
Overnight on Sunday, October 11, attackers logged into refrigeration management systems and changed their settings. Les Mousquetaires, the group behind Intermarché and Netto, said units were set to defrost and heated to as much as 50°C. Le Monde reported that some defrost cycles were stretched from one hour to eight, long enough to ruin stock while delaying staff alarms. In some stores, temperatures climbed for about six hours before anyone noticed.
By Monday morning the scale was visible:
| Retailer | Reported impact |
|---|---|
| Intermarché and Netto (Les Mousquetaires) | At least 300 stores; all affected fresh and frozen products discarded |
| Coopérative U | 80 to 100+ stores (figures vary by date of report); cold chain held in most |
| Carrefour | About 80 supermarkets |
| Monoprix | About 30 stores, roughly 5% of the network |
| E.Leclerc | “Several stores,” via an attacked supplier |
| Auchan | Named in Reuters reporting; no store count |
France’s national cyber-alert team, CERT-FR, issued alert CERTFR-2026-ALE-012 on October 12, citing “numerous compromises” of Danfoss AK-SM and AK-SC controllers. Its update the next day added Copeland and Dixell XWEB controllers to the list. That matters: this was not one vendor’s bad week but a class of equipment. Finance Minister Roland Lescure put the total at about 700 stores and said the attack “touches the heart of our food security.” The Paris prosecutor’s cybercrime section opened an investigation that includes the reported fires.
One detail is still contested. Les Mousquetaires said the intrusion came through a service provider that manages refrigeration at some of its stores, and E.Leclerc also pointed to an attacked supplier. Neither CERT-FR nor Danfoss has said which vulnerability, if any, was used.
Beyond France: The Sekoia Findings
The early coverage framed this as a French story. It isn’t. Felix Aime, a senior threat-intelligence analyst at Sekoia, told Reuters that the attack also reached refrigeration systems in Spain, Portugal, Poland, Germany and Belgium. No retailers in those countries have publicly confirmed losses on the French scale, which suggests either a lighter touch outside France or quieter disclosure. [CONFIRMED on Sekoia’s finding; DATA DEFICIT on impact outside France]
The exposure data points the same way. On October 12, security researcher Baptiste Robert counted 2,752 internet-exposed Danfoss systems, 1,590 of them in France. A day later, Reuters found at least 4,500 Danfoss interfaces visible through the Shodan search engine, with exposed or affected devices also noted in South Africa, Portugal, Belgium, Poland, Spain and Germany. Claroty’s August research had already counted 2,765 exposed units of the newer AK-SM 800A model alone. Danfoss says it has more than 50,000 installations worldwide.
Two neighboring incidents need to be kept separate:
- The Netherlands and Belgium (Ahold Delhaize). The Dutch owner of Albert Heijn disconnected systems over a “security issue” that started the same Sunday, suspended home delivery and warned of empty fresh-food shelves because of blockages at distribution centers. The Dutch National Cyber Security Centre said it saw no link to the French attack. [CONFIRMED as a separate incident; no link established]
- US military commissaries (August 2026). In the last week of August, at least six commissaries on US bases, including Fort Irwin, Fort Huachuca, F.E. Warren and Naval Station Newport, lost refrigeration. Fort Huachuca described an “overnight equipment failure” in which all freezers went into defrost and all frozen food spoiled. The Army Criminal Investigation Division’s Cyber Field Office and the Air Force Office of Special Investigations confirmed investigations; the Defense Department has acknowledged only a “possible refrigeration disruption.” A 2022 Defense Commissary Agency specification cited the Danfoss AK-SM 800A as a basis of design. Separate September outages at European commissaries were attributed by the agency to routine wear. [CONFIRMED on the outages and investigations; SPECULATIVE on any link to October 11]
Why Is a Supermarket Freezer on the Internet at All?
This is the question that matters most, and it applies to every country with a modern food retail sector. The short answer is that nobody decided to put freezers on the internet. A series of reasonable-sounding business decisions did it for them, and no one in the chain owned the risk. CommandEleven Intelligence identifies seven drivers.
1. The retailer doesn’t run its own refrigeration. Most supermarkets buy cold as a service. Coopérative U’s chief executive said his stores don’t buy from Danfoss directly; they are customers of refrigeration contractors. The contractor installs the system, holds the passwords and needs to reach it from the office. That leaves a basic question unanswered in most contracts: who owns the firmware, the credentials and the network exposure? In France on October 11, the answer was effectively nobody.
2. Food-safety law requires the alarm to get out. European food-hygiene rules require food businesses to control and document temperatures, and a freezer failing at 2 a.m. has to reach an on-call technician, not a sleeping store. Remote alarm forwarding and temperature logging are legitimate, and often legally driven. The problem is how they were connected, not that they were.
3. Energy and refrigerant rules reward remote control. Refrigeration is the largest electricity load in a typical supermarket. France’s tertiary-sector energy decree requires large commercial buildings to cut consumption sharply by 2030, and the EU’s 2024 F-gas Regulation tightened leak checking and detection for refrigeration systems. Both push operators toward centralized, always-on monitoring and remote set-point tuning.
4. Labor costs. A technician who can see 300 stores from one screen replaces a fleet of service vans. The savings are real, which is why the model spread.
5. The cheapest connection is the most dangerous one. Doing remote access properly means a managed gateway, a VPN, unique credentials and multi-factor authentication. Doing it cheaply means forwarding a port on the store router, or dropping in a cellular modem with a public address, and publishing the controller’s built-in web page to the world. Danfoss’s system managers run an embedded web server precisely so technicians can administer them remotely. Claroty’s research found a hidden “code of the day” maintenance login in the AK-SM 800A, a sign of how deeply remote service access was designed into the product.
6. The equipment outlives its security support. Refrigeration controllers are expected to run for 15 years or more. Danfoss ended support for the AK-SC 355 in 2016 and the AK-SM 800 in 2021, and most affected units were those models. A box that still keeps food cold doesn’t get replaced, so stores were running internet-facing devices that will never receive another security fix. Danfoss has said a 2023 login-bypass flaw in older models has no fix for end-of-life products.
7. No regulator owns the store’s refrigeration network. Food inspectors check the temperature log, not the network. The EU’s NIS2 cybersecurity directive covers food businesses engaged in wholesale distribution and industrial production; store-level retail equipment largely falls outside its mandatory scope. Energy regulators care about consumption, not intrusion. The refrigeration controller sits in the gap between all of them.
The pattern is not unique to food. Part 1 of this series documented the July 2026 campaign against internet-exposed controllers at US water utilities. The same logic of remote convenience over resilience runs through fuel-station tank gauges, building management systems and hospital equipment. In each case, the people who chose the connection were not the people who would carry the cost of its failure. [ASSESSED]
The Bill: What the Attack Cost
No official total exists. The data points so far:
- Two supermarkets in Alsace reported combined losses of about €270,000.
- Thierry Cotillard, head of Les Mousquetaires, put his group’s losses at “tens of millions of euros nationwide in a single day.”
- BFM TV estimated losses would reach millions of euros; other outlets’ figures of “hundreds of millions” carry no source.
CommandEleven Intelligence’s estimate for France, built from those anchors, is set out below. It is an order-of-magnitude estimate, not an accounting. [ASSESSED]
| Cost line | Basis | Estimate |
|---|---|---|
| Food destroyed | About 700 stores at €40,000 to €135,000 of chilled and frozen stock each (the upper figure is the Alsace average) | €28M to €95M |
| Controller replacement and recommissioning | End-of-life controllers cannot be patched and must be replaced; supported units need a factory reset and full reconfiguration, per CERT-FR. Roughly €7,000 to €20,000 per store in parts and contractor time | €5M to €14M |
| Physical damage | Cases, evaporator fans, seals and wiring stressed by hours of heating; fire damage at several stores. Assumes 5% to 15% of stores need significant repair | €1M to €8M |
| Direct total, France | Excludes lost sales, disposal, cleaning, staff overtime and insurance effects | ≈ €35M to €120M |
The larger bill is the one still to come: securing the exposed estate that hasn’t been hit yet. Every one of the thousands of internet-facing controllers needs either replacement or a proper remote-access gateway. At a conservative €3,000 to €10,000 per site, fixing just the 4,500 Danfoss interfaces Reuters found would cost €13 million to €45 million, before Copeland, Dixell and other vendors are counted. That is still a fraction of what one more night like October 11 costs. [ASSESSED]
Who Did It? What the Evidence Supports
As of October 15, there is no claim of responsibility, no ransom demand and no official attribution. The competing readings:
- Criminal extortion. Cotillard has suggested an economic motive. Against it: no ransom note has surfaced, and extortion usually announces itself.
- Opportunistic vandalism. Pen Test Partners’ Ken Munro has floated “kids messing around,” noting that a state would hardly bother with a subset of French fridges. Against it: simultaneous action across hundreds of stores and several countries, apparent use of a contractor pathway and settings chosen to delay alarms suggest planning beyond casual mischief.
- State or state-aligned demonstration. Pro-Russian and Iran-aligned groups have both targeted European and US operational technology in 2025 and 2026, and a low-cost attack that empties shelves fits a pressure-and-signaling pattern. Against it: no evidence has been published, and attribution to Moscow or Tehran without evidence would be speculation. CommandEleven Intelligence does not make that call.
- A link to the French protests. No reporting supports it. The protests are domestic and street-based; the attack was technical, cross-border and timed for an empty Sunday night.
CommandEleven Intelligence’s assessment is that the attack was a deliberate, prepared operation by an actor with the ability to find and use exposed controllers at scale, and that its purpose was disruption rather than profit. Who that actor is remains an open question. [ASSESSED, low confidence on actor]
What Has to Change
For retailers and cold-storage operators, now:
- Find every controller and every path to it, including contractor links and cellular modems, and take direct internet access away. CERT-FR’s instruction is to disconnect or filter access to all affected controllers.
- Put any remaining remote access behind a managed gateway with multi-factor authentication and unique credentials.
- Keep an inventory with firmware versions and end-of-life dates, and budget to replace unsupported controllers.
- Write firmware, credential and remote-access duties into refrigeration contracts, so the security of the connection has an owner.
- Monitor for the warning signs this attack produced: set-point changes, unusually long defrost cycles and logins at odd hours.
For governments: bring food retail and cold storage explicitly into the scope of national operational-technology security rules, and give food-safety inspectors a cyber line on the checklist. A temperature log that an attacker can falsify proves nothing.
Household Preparedness: The $500 Cold-Chain Plan
When the cold chain breaks, the risk to households is twofold: empty fresh-food shelves for a few days, and food that warmed up before it reached you. This plan, built on public food-safety guidance, costs about $500 and is kept separate from the threat analysis above.
- Thermometers ($15). Put one in the fridge (40°F / 4°C or below) and one in the freezer (0°F / -18°C). You can’t judge safety by smell.
- An eight-day pantry ($250 to $300). A Dutch study by Clingendael and Erasmus University this year advised households to keep eight days of food rather than three. Shelf-stable protein, grains, canned vegetables and fruit, and milk in cartons.
- Water ($40). At least a gallon per person per day for the same period.
- A good cooler and ice packs ($100). Buys you a day if your own power fails or you need to carry frozen food home safely.
- Know the two-hour rule. Perishable food held above 40°F for more than two hours should be thrown out. If a store’s freezer cases look warm or partly thawed, don’t buy.
- Watch for withdrawals. After an incident like this, retailers pull products whose storage they can’t guarantee. Check your retailer’s recall notices before using anything bought that week.
Outlook and Indicators
- A claim or attribution. Watch the Paris prosecutor, ANSSI and any group posting proof on Telegram.
- Exposure counts. Do the 4,500 visible Danfoss interfaces fall sharply over the next month? If not, a repeat is likely.
- Target creep. Any similar attack on a distribution center, cold-storage warehouse, pharmacy chain or hospital would mark escalation from retail nuisance to supply disruption.
- The US findings. Any conclusion from the Army and Air Force investigations into the August commissary outages.
- Regulation. Whether France or the EU moves food retail refrigeration into mandatory cyber rules.
What This Dossier Does Not Claim
- It does not claim to know who carried out the attack.
- It does not claim the August commissary outages and the October attack are connected; it notes the similarity and the open investigations.
- It does not claim the Ahold Delhaize incident in the Netherlands is part of the same campaign.
- Its cost figures are CommandEleven Intelligence estimates built from limited public data points, not reported totals.
Frequently Asked Questions
What happened to French supermarkets’ refrigerators?
On the night of October 11, 2026, attackers remotely took over refrigeration controllers at about 700 French supermarkets, forced fridges and freezers into defrost and raised some to 50°C (122°F), spoiling food and causing some fires.
Was the attack limited to France?
No. Analysis by the threat-intelligence firm Sekoia, reported by Reuters, found affected systems in Spain, Portugal, Poland, Germany and Belgium as well.
Why are supermarket fridges connected to the internet?
So outside contractors can maintain them remotely, alarms can reach on-call technicians, temperatures can be logged for food-safety rules and energy use can be managed centrally. The danger comes from connecting them directly to the internet instead of through a secured gateway, and from running controllers that no longer receive security updates.
How much did the attack cost?
No official total has been published. CommandEleven Intelligence estimates direct losses in France at roughly €35 million to €120 million in food and equipment, before lost sales.
Who was behind it?
As of October 15, 2026, no group had claimed the attack and no government had attributed it.
Related CommandEleven Intelligence Coverage
- Food Chain Reaction Revisited: The 2015 War Game Predicting America’s 2026 Food Crisis
- The Salt Typhoon Playbook: China’s Cyber Campaign Against Global Infrastructure
- Grey Zone Warfare Explained: The Framework Behind China, Russia, Iran and North Korea
Sources
- Cyberattack targeting refrigeration systems hits 700 supermarkets, French government says, Associated Press, October 13, 2026
- Hundreds of supermarkets in France hit by ‘unprecedented’ cyberattack, Al Jazeera, October 13, 2026
- Attackers Heat French Supermarket Refrigeration Systems, The Hacker News, October 13, 2026
- French Supermarket Fridge Cyberattacks and the Risks of Internet-Connected OT, Nozomi Networks
- EU Grocers Pay a Steep Price for Unpatched Fridge Firmware, Dark Reading
- Thousands of supermarket fridges still exposed after cyberattack, Euronews, October 14, 2026
- Refrigeration Controller Hack Spoils Food Across European Supermarkets, SecurityWeek, October 13, 2026
- Hackers manipulate refrigeration systems at French supermarkets, Cybersecurity Dive, October 13, 2026
- Hackers turn up supermarket fridges to 50°C, threatening millions in food losses, Cybernews
- A cyberattack damages the food of dozens of supermarkets in France, Belgium and the Netherlands, Ara, October 12, 2026
- Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers, Claroty Team82, August 9, 2026
- DoD confirms refrigeration disruption at military commissaries, Military Times, August 28, 2026
- Army CID investigates commissary refrigerator outages, Stars and Stripes, September 1, 2026
- Freezer outages at Europe commissaries, Stars and Stripes, September 30, 2026
- Regulation (EC) No 852/2004 on the hygiene of foodstuffs, EUR-Lex
- Regulation (EU) 2024/573 on fluorinated greenhouse gases, EUR-Lex
- Directive (EU) 2022/2555 (NIS2 Directive), EUR-Lex
The Critical Infrastructure at Risk Series
- Critical Infrastructure at Risk: Water Systems – Part 1
- Critical Infrastructure at Risk: The Electricity Grid – Part 2
- Critical Infrastructure at Risk: Natural Gas – Part 3
- Critical Infrastructure at Risk: Communications – Part 4
- Critical Infrastructure at Risk: Financial Systems – Part 5
- Critical Infrastructure at Risk: Synthesis – Part 6
- Critical Infrastructure at Risk: The Cold Chain – Part 7 (you are here)
