---
title: "The Fridge Hack That Hit 700 French Supermarkets Came Through Doors Left Open"
description: "Old controllers, a contractor’s modem and a login code worked out from the date let attackers spoil food and start fires"
author: "Jan Sokol"
published: 2026-10-14T21:35:09Z
modified: 2026-10-15T03:16:56Z
url: https://rews.cc/a/the-fridge-hack-that-hit-700-french-supermarkets-came-throug-213a5e
language: en
tags: ["cybersecurity", "infrastructure", "security", "ai", "iot", "europe", "business"]
publisher: "Rews (https://rews.cc)"
---

# The Fridge Hack That Hit 700 French Supermarkets Came Through Doors Left Open

*Old controllers, a contractor’s modem and a login code worked out from the date let attackers spoil food and start fires*

By Jan Sokol · October 14, 2026 · https://rews.cc/a/the-fridge-hack-that-hit-700-french-supermarkets-came-throug-213a5e

## In brief

- Hackers remotely put supermarket display cases in defrost mode, pushing some to 50C, spoiling food and causing fires
- France’s finance minister said about 700 of the country’s 10,000 supermarkets were affected
- Outdated Danfoss controllers had a hidden login using a code derived from the date, valid on every unit that day
- ANSSI said controllers from Danfoss, Copeland and Dixell were breached; vendors blamed discontinued models
- Spain, Portugal, Poland, Germany and Belgium were reportedly hit too; no one has claimed the attack

One Sunday night this month, the cold went out of French supermarkets. Nobody forced a door or cut a cable. According to [CNN](https://www.cnn.com/2026/10/14/europe/france-cyberattack-supermarket-fridges-intl), attackers took over the refrigeration controls from a distance and switched the display cases into defrost mode. Some units were driven up to 50C. Food spoiled, and in some stores electrical fires broke out. Roland Lescure, the finance minister, put the toll at about 700 of the country’s 10,000 supermarkets. The first night of the attack is told [in an earlier rews story](https://rews.cc/a/the-night-french-supermarket-freezers-were-ordered-to-heat-u-0c62d3).

It is an old pattern. When a great system breaks, the cause usually turns out to be small: a habit nobody questioned, a box nobody owned, a budget line nobody wanted to sign.

## A password written by the calendar

[Dan Goodin, writing for Ars Technica](https://arstechnica.com/security/2026/10/fridge-hack-costing-millions-and-sparking-fires-stemmed-from-poor-security/), traces the damage to neglect rather than genius. The affected stores were running controllers on outdated firmware. They also likely failed to hide the devices behind a VPN and to keep a restricted list of IP addresses allowed to log in. Both precautions are standard practice, and both are often skipped.

![A stylized refrigerated display cabinet holds milk cartons, cheese, and food containers, with an open electrical control box on its side against a yellow background.](https://rews.cc/img/2613f74f463e3cacc250317578f273482b3bcb03.webp)

Researchers at the British security firm Pen Test Partners have described how the break-in worked, in [a post published on 14 October](https://www.pentestpartners.com/security-blog/you-dont-need-a-nation-state-to-warm-up-a-fridge/). The machines at the centre of it were Danfoss AK-SM and AK-SC system managers, the units that set the temperature for every case in a store. Many were connected through a contractor’s cellular modem, “on a link the retailer often does not own, cannot see, and has no record of.” To get to 50C, the attackers kept the defrost heaters running. The system manager let them push that setting to every case controller at once and silence the alarms that should have gone off.

The way in was almost mocking. On older units, a hidden login path handed out an administrative session to anyone who supplied the right code. That code, the researchers write, “is generated from the device’s date by a fixed algorithm, with no per-device secret,” so that “the same code is valid on every unit for a given day.” The flaw is catalogued as CVE-2025-41450, and Danfoss removed the path from release 4.2 onwards. A store that never upgraded kept a lock whose key was the date on the calendar.

## Discontinued, end-of-life

Danfoss was not the only maker involved. France’s cybersecurity agency, ANSSI, told CNN that the hackers got into controllers from at least three companies: Danfoss of Denmark, Copeland of the United States, and Dixell, which Copeland owns.

![A long yellow key passes through keyholes in three cream-colored locks of decreasing size against a bright blue background.](https://rews.cc/img/8bd5cef678b7169f6221ee659f5be1e81fe064f6.webp)

The manufacturers answered in the language manufacturers use. Copeland told Ars Technica by email that it had found a vulnerability “identified in a discontinued, end-of-life generation of controllers” and was working with customers to prevent anything similar. Danfoss did not immediately answer Ars Technica’s questions. CNN reported that Danfoss also pointed to discontinued models, saying many of the affected units “no longer receive software or security updates” or were “running outdated software.”

Read one way, that is an explanation. Read another, it is a description of the stock in hundreds of stores: equipment the people who made it had stopped looking after, still holding the milk and the meat.

Nobody can say they weren’t warned. The security firm Claroty flagged the danger of ignoring these basic steps last October, and the US Cybersecurity and Infrastructure Security Agency issued its own warning in February. Pen Test Partners now lists the steps that would have kept the attackers out:

> Cyber hygiene would have prevented the access: take the controller off the public internet, put remote access behind a VPN and an IP allowlist, bring third-party kit onto the network in a controlled, owned and documented way rather than leaving it on a contractor’s own connection, change known and default credentials, and patch to a current release.

## Silence, and the bill

France was not the only country hit. Ars Technica reports that stores in Spain, Portugal, Poland, Germany and Belgium were also affected, and estimates that the mass hack likely cost tens or hundreds of millions of euros.

![A shopping cart holds melting groceries, including a milk carton and fruit, while drops fall toward scattered coins on a teal background.](https://rews.cc/img/9fbdc19dc452697466e9b49f80c78c02339281bb.webp)

Nobody has claimed it. No one has demanded a ransom or bragged online. That silence leaves two possibilities, Ars Technica suggests: vandalism on a mass scale, or a nation-state or other foreign actor trying to disrupt a whole continent. Pen Test Partners, as the title of its post makes clear, thinks a state is not needed to explain it. The firm adds a warning of its own. In separate research still going through coordinated disclosure, it found internet-exposed controllers from another vendor that a botnet had already compromised. “Someone is collecting footholds on the same class of device,” the researchers write.

## The ledger

Behind the warm cases sits an older contest inside most companies, between the people who guard the money and the people who guard the systems. A new controller costs real money and earns nothing back on the day it goes in, while the old one still keeps things cold. So the old one stays. Its contractor’s modem keeps blinking in a back room, connected to the whole world and recorded on nobody’s inventory.

One could put it like this: for an institution, a risk becomes real only once it has a price. Until then it belongs to the engineers. Afterwards it belongs to the board.

Executives at the supermarket chains that were hit will probably learn that lesson now, at a cost of spoiled stock and burned wiring. Whether chains that were spared will spend the money before their own Sunday night is much less certain. Pen Test Partners, meanwhile, says someone is already collecting footholds on the next batch of devices.