Cyberattacks on refrigeration systems spoiled food in French shops

Attacks on refrigeration systems in French shops began overnight on 11–12 October 2026. Refrigerator and cold-storage settings were changed, food warmed up, and some shops had to throw away stock. On 13 October, France’s economy minister said the attacks had affected 700 shops. He said the country’s food supply was not at risk.

By Urmas Kungla · ADVIT. Information checked on 14 October 2026.

Photos from the scene: A Reuters gallery published by CNA shows empty refrigerators and boxes of spoiled goods at an Intermarché in Paris. The boxes appear in the gallery’s third photo, taken by Lucien Libert on 13 October 2026.

How can a cyberattack spoil food?

A shop’s refrigeration system is managed by a controller, essentially a small computer. It can be used to change temperatures and defrost schedules. If an attacker gains access, they can change the settings so the stock is no longer kept cold. Security researchers at Claroty have described the capabilities and vulnerabilities of these controllers.

The damage is tangible. Charles Dezon, owner of an Intermarché shop in Gradignan, told Le Monde that his shop lost €21,000 worth of stock at purchase cost. That is one shop’s experience, not an average across all affected shops. You can restore a configuration. There is no backup for melted ice cream.

Media reports have also described very high temperatures and fires. According to the parliamentary debate on 13 October, the link between the fires and the attacks was still being investigated. Not every claim in circulation can therefore be treated as a confirmed fact. A fridge turning into an oven sounds like a bad joke. But in a world that depends on software, settings have very real consequences.

What happened to the Danfoss refrigeration systems?

The official warning from France’s CERT-FR confirms compromises of Danfoss AK-SM and AK-SC controllers, as well as Copeland/Dixell xweb systems. It draws attention to management interfaces that are directly accessible from the internet. The warning does not identify the exact vulnerability used or the attacker.

Danfoss announced in 2025 that support for several older controllers was ending and recommended replacing them. This does not explain all the current attacks, but it is a reason to check product support even when a device still works.

How does this affect me?

As a customer, you might find empty refrigerated shelves, less choice or a temporarily closed shop. As a business owner, you could face downtime, the cost of spoiled stock and the work of restoring operations. Your office computers might be working perfectly throughout.

Even if you do not have cold storage, consider your network-connected heating, ventilation, cameras and access-control systems. Which of them could disrupt your business? Estonia has already seen real effects: according to the Estonian Information System Authority (RIA), attacks on industrial automation disrupted local boiler plants and pumping stations in late 2023. That was a separate incident.

Watch how the attack affected shops

NBC News report, 2 min 51 sec. Published on 14 October 2026.

What should you check in your business?

CERT-FR’s recommendations and the guidance on securely connecting operational technology suggest four practical checks:

1. Who can access the device? Its management interface should not be on the public internet. Remote maintenance should use a protected connection, individual user accounts and multi-factor authentication.
2. Does the manufacturer still support it? Check available updates and the support end date. Updates should be tested and installed at a time agreed with the maintenance provider. Replacing an unsupported device or adding protection needs a plan.
3. Does an alert reach a real person? Test notifications and agree who responds, including at night. A warning flashing on a screen is not enough.
4. Have you practised recovery? Your IT partner and equipment maintenance provider need to know their roles. Changes to connections should be agreed with them so the equipment keeps operating safely and essential monitoring is not lost unnoticed.

For me, there is a wider point here. Behind software are people with workloads, deadlines and stress. Commitment matters, but checks need to be in place too. The state of critical information systems should be reviewed at least once a week. Alerts need continuous monitoring, security testing needs a regular schedule, and recovery needs to be practised.

I am keeping an eye on this case and will write again if significant new information emerges.

Stay safe!
Urmas