On the night of October 11, 2026, someone logged into the refrigeration controllers at hundreds of supermarkets across France and told the defrost heaters to stay on. For six hours.
Fridges climbed to 50°C — 122°F. Frozen aisles thawed. Whole cases of food went in the dumpster, and in a handful of stores the overworked heaters started fires. The Paris prosecutor's office confirmed both the food losses and the fires. Two stores in Alsace alone lost €270,000 in stock in one night. Total damage will likely run into the tens of millions of euros.
Intermarché took the biggest hit — roughly 150 stores by the company's own count — but the same night touched Coopérative U, Carrefour Market, Monoprix, and E.Leclerc. Stores in Belgium, Germany, the Netherlands, Portugal, Poland, and Spain have the same controllers with the same holes. France's cybersecurity agency (ANSSI) took over the investigation. Nobody knows who did it, and that's the unsettling part: it required so little skill that a bored teenager is as plausible as a state actor.
How the "fridge hack" actually worked
The attacked devices were Danfoss AK-SM800 and AK-SC355 refrigeration system managers — the central "brain" that coordinates every cooler, case, and cold room in a store. A store doesn't have one fridge. It has dozens of cases fed by central compressor racks, all steered by this one box, which also holds the legally required food-safety temperature records.
Three failures stacked on top of each other:
1. The controllers were on the public internet. Refrigeration is usually installed and serviced by a third-party contractor, and the easiest way to give that contractor remote access is a cellular modem on the unit. The device ends up on the internet over a connection the store's own IT team doesn't own, can't see, and has no record of. Researchers counted thousands of these exposed; days after the attack, roughly 4,500 Danfoss controllers were still reachable.
2. They had a built-in back door. These controllers ship with a hidden login path where the password is the device's current date. Not a per-unit password — a code computed from the date itself. The controller will even tell you today's date without logging in first. Figure out the algorithm once and the same daily code opens every exposed unit on the planet, scriptable. Security researchers published this in 2023 and again in August 2025, complete with CVE numbers, a CISA advisory, and a firmware fix. The vendors' own advisories had been out for over a year.
3. They were end-of-life. The AK-SC355 stopped receiving updates in 2016. The AK-SM800 in 2021. The manufacturer had been telling customers to replace them for years. Nobody did, because a refrigeration controller that works is invisible — right up until it costs a supermarket chain millions in one night.
Once inside, the attackers didn't just turn a dial. They reconfigured the defrost settings on dozens of case controllers at once — schedule, termination temperature, time limit, all ordinary documented parameters — and silenced the alarm system in the same push. Defrost heaters are built to run for three minutes; held on for hours against tired electrical connections, they overheat and smoke. The fires were a side effect, not the goal.
Why a Knoxville homeowner or shop owner should care
Your house and mine don't have a Danfoss system manager. But the pattern in this story shows up everywhere:
- Contractors install connected gear on their own cellular link — smart thermostats, gate openers, irrigation controllers, walk-in cooler monitors — and it never touches your network's visibility.
- Appliances run years past their update window, quietly.
- Devices ship with computed or default credentials nobody ever changes.
Nothing about this attack required nation-state skill. Pen Test Partners, the consultancy that tore the incident apart, found internet-exposed building controllers from another vendor already carrying a botnet implant — someone is collecting footholds on exactly this class of device, waiting. They expect copycats within weeks of the French news.
The short version of what would have prevented it
All of this was fixed by basic hygiene, per both Pen Test Partners and France's own CERT alert the day after the attack:
- Connected appliances don't get direct internet access. A smart fridge does not need to talk to the internet any more than your toaster does. On small networks, anything with a cellular modem or cloud account gets segmented, owned, and documented.
- Firmware gets checked on a schedule — and devices past their update window get retired, not kept running.
- Default or computed credentials get changed the day something is installed. If the password is on the internet, it isn't a password.
What we do
At The Fiber Dad we run network security audits across Knoxville that do exactly this inventory: find the devices on your network you didn't put there, flag the ones past their security shelf life, and put the ones that talk to the internet behind a lockdown ($149 audit tier) or a full isolated segment ($299 isolation tier) instead of a contractor's SIM card.
If hackers can ruin a supermarket chain's cold storage with a password anyone can compute, your smart doorbell deserves a second look.
Questions about what's on your network? Reach out — [email protected] or (865) 405-0828.
Sources:
The Guardian · Reuters · Wikipedia: 2026 French supermarket refrigerator hack · Pen Test Partners: You don't need a nation state to warm up a fridge · Ars Technica · Claroty Team82 research · CERT-FR alert CERTFR-2026-ALE-012 · CISA ICSA-25-140-03