50°C Fridges in French Supermarkets: A Lesson for Connected OT
On 12 October 2026, a cyberattack reportedly drove refrigerators in hundreds of French supermarkets up to 50°C. The case shows how risky it is to expose industrial controllers to the internet, even in the cold chain.
According to trade press reports, on 12 October 2026 hundreds of French supermarkets were hit by a cyberattack on their in-store refrigeration systems. The attackers reportedly took control of the equipment and pushed refrigerator temperatures to around 50°C for several hours overnight. Food worth an estimated several million euros is said to have been destroyed. The information is still evolving: this article is current as of 13 October 2026.
What happened
The software involved is reportedly supplied by the Danish company Danfoss. The Mousquetaires group (Intermarché and Netto) stated that a service provider managing refrigeration in its stores had reportedly been attacked, putting the number of affected stores at around 300. Other retail banners cited as affected include Coopérative U, Carrefour, Monoprix and E.Leclerc.
At the time the news was published, no one had claimed responsibility for the attack and no ransom demand had been reported. The identity and motives of the perpetrators, the total number of stores involved and the actual extent of any data deletion therefore remain uncertain.
The technical picture: systems reachable from the internet
Sekoia analyst Félix Aimé, drawing on Censys data, counted more than 2,700 StoreView systems reachable via the internet, around 1,700 of them in France. Almost 50% of the exposed French installations appear to be offline, accounting for nearly 90% of all offline systems detected in Europe. A very small number of exposed systems also exist in Spain, Portugal, Poland, Germany and Belgium; Sekoia cannot confirm that retail networks outside France were deliberately targeted.
The attack does not appear to have been technically complex: the control systems were directly reachable from the internet. It is not confirmed whether access was gained by exploiting a specific vulnerability or default credentials, and access was probably possible for a long time. Some systems may have been wiped or rendered unusable, which would require the refrigeration control configuration to be rebuilt from scratch, but this too is not yet fully confirmed.
A controller reachable from the internet is an exposed controller, regardless of who makes it.
Why it matters to manufacturers too
According to experts cited in the press, any link in the food supply chain with internet-connected equipment is at risk, manufacturers included, and a breach at one organization can expose the entire chain. Professor Daniel Dresner (University of Manchester) notes that OT connected to IT, or remote monitoring and adjustment, widens the exposure. A Zscaler ThreatLabz report, cited in the same coverage, also ranks manufacturing among the sectors hardest hit by ransomware.
The remote connectivity of cold rooms, process lines and monitoring systems is the same as that found in smart factories. It brings the same operational benefits and the same attack surface.
What to check now
The case gives plant managers, operations leaders and IT/OT managers a good reason to run a targeted review. Some starting points:
- Exposure inventory: check which controllers, supervisory systems and web interfaces are reachable from the internet, including by using public scanning tools.
- Credentials: look for default accounts and passwords and replace them, especially on devices installed years ago.
- IT/OT segmentation: verify that the plant network is separated from the corporate network and that remote access goes through controlled channels, not open ports.
- Service providers: ask maintenance contractors and remote system operators how they protect access and credentials, since in the French case the weak point reportedly lies with a provider.
- Recovery plan: keep backups of controller configurations and know how to rebuild them if systems are rendered unusable.
The precise causes of the French attack are not yet known, but the technical picture described suggests that basic measures, such as reducing exposure and managing credentials, remain among the most effective defenses for connected OT.