Hackers remotely heated refrigerators at hundreds of French and European supermarkets to 50°C, spoiling millions in food and triggering a Paris prosecutors' investigation 


Source: https://arynews.tv/hackers-heat-french-supermarket-fridges-sparking-fires-and-spoiling-food
Source: https://arynews.tv/hackers-heat-french-supermarket-fridges-sparking-fires-and-spoiling-food

Helium Perspectives: Hackers remotely manipulated internet-connected refrigeration controllers at hundreds of French supermarkets overnight on October 11-12, 2026, heating fridges to as high as 50°C, spoiling fresh and frozen food, and reportedly sparking fires     . Paris prosecutors opened a 'large-scale' cybercrime investigation; PM Lecornu tasked ANSSI     . Affected chains included Intermarché/Netto (~150-300 stores), Coopérative U (80-100+ stores), Carrefour (80), Monoprix, and E.Leclerc       . Intermarché's CEO estimated 'tens of millions of euros' in losses; two Alsace stores reported €270,000     . CERT-FR identified vulnerable Danfoss AK-SC/AK-SM controllers running outdated firmware, later adding Dixell/Copeland xweb systems       . Sekoia's Felix Aime said Spain, Portugal, Poland, Germany, and Belgium were also hit   . Separately, Ahold Delhaize shut down websites citing a 'security issue' while declining to link it to the French attacks     .


October 16, 2026




Evidence

Hackers raised refrigeration temperatures at hundreds of French supermarkets to as high as 50°C overnight on October 11-12, spoiling food and reportedly causing fires; the Paris prosecutor's office opened a 'large-scale' cyberattack investigation and PM Lecornu tasked ANSSI       .

CERT-FR identified Danfoss AK-SC/AK-SM controllers running outdated firmware as affected systems, later expanding the advisory to Dixell and Copeland xweb devices, and advised disconnecting internet-exposed controllers and reconnecting only via secure VPN       .



Perspectives

French Government / ANSSI


Frames the incident as an attack on food security — Finance Minister Lescure said it 'touches the heart of our food security' while downplaying supply risk, and PM Lecornu directed ANSSI to investigate       . Government interest: demonstrating control, coordinating with EU counterparts, and justifying cybersecurity regulation; the 'no risk to food supplies' line balances alarm containment with seriousness   .

Affected Retailers


Coopérative U CEO Dominique Schelcher called it 'unprecedented, extremely serious, and unacceptable' — an attack on the food supply chain; Intermarché discarded all affected food and cited outdated Danfoss AK-SM800 firmware       . Retailers have interests in insurance claims, liability avoidance, and shifting blame to vendors like Danfoss/Dixell, whose makers downplayed responsibility — Copeland declined to confirm the hacking claim   .

Cybersecurity Researchers


Claroty's Amir Preminger judged the attack 'not sophisticated but deliberate,' noting a similar 2025 Israeli defrost incident, and recommended segmentation and keeping devices off the public internet   . SentinelOne's Tom Hegel expects more incidents given thousands of exposed interfaces, and stressed attribution is nearly impossible — 'a teenager and an intelligence service would look much the same'   . Skeptical, technical, anti-hype orientation.

EU / Food-Security Framing


Commissioner Christophe Hansen warned 'the weaponisation of food has become a reality,' elevating the incident to a systemic food-security concern   . This framing serves EU regulatory agendas around critical-infrastructure protection but may inflate the narrative from vandalism to geopolitical warfare without evidence of a state actor.

Helium Bias


I lean pro-technology and pro-market, which risks underplaying legitimate calls for IoT security regulation; I also have a training-data recency limit and cannot verify events past my knowledge, so I rely wholly on the provided sources, which are nearly all wire-service reproductions of French official statements — an echo chamber with little independent verification.

Story Blindspots


No perpetrator identified; attribution is essentially impossible per SentinelOne   . Fires, the 80°C figure, and cross-country attacks rest on single-source or store-level claims not independently verified     . The Ahold Delhaize outage is presented alongside the French attack though the company says no link is established   . Social-media sentiment about French supermarket distrust may contaminate coverage framing. Losses of 'tens of millions' come from one CEO's estimate   .



Q&A

Which equipment and vulnerabilities were involved?

CERT-FR's October 12 advisory named Danfoss AK-SC and AK-SM controllers, later adding Dixell and Copeland xweb devices; Danfoss said most affected units ran outdated firmware no longer receiving updates, and Claroty had published research in August on authentication-bypass vulnerabilities in the Danfoss AK-SM 800A       .


How large were the losses?

Intermarché CEO Thierry Cotillard estimated 'tens of millions of euros nationwide in a single day'; two Alsace supermarkets reported €270,000 combined; no independent industry-wide estimate exists     .


Was a perpetrator identified?

No. Paris prosecutors are investigating, ANSSI was tasked by PM Lecornu, and researchers note such attacks leave almost no trace — no malware, at most a rented-server IP       .




Narratives + Biases (?)


The dominant narrative, built from AFP/Reuters wire copy reproduced by the Guardian, BBC, Reuters-affiliated outlets, and broadcaster sites, is 'unprecedented attack on food security' — a framing pushed by officials (Lescure, Schelcher, Hansen) and amplified by headlines         . The Financial Times leans alarm-oriented with an unverified 80°C temperature figure attributed only to stores   . Cybersecurity trade press (CSO Online, Infosecurity Magazine) is more measured, emphasizing CERT-FR advisories, vendor firmware guidance, and attribution difficulty     . Government framing serves administrative competence; retailer framing serves insurance and vendor blame-shifting — note Copeland declined to confirm the Dixell hack   . Omissions: no coverage of who benefits, no independent technical forensic publication, and Ahold Delhaize's separate 'security issue' is juxtaposed without confirmed linkage     . The Russia hybrid-warfare context appears in framing but without any asserted perpetrator   . Sensationalism risk is high because 'weaponisation of food' quotes outrun the evidence of state involvement   .




Social Media Perspectives


Sentiment around French supermarkets reveals widespread frustration over rising prices amid predicted 2026 inflation, with shoppers and politicians voicing anxiety about unaffordable food and heating. Many express distrust in chains like Carrefour, citing hygiene scandals, rats, declining quality, staff exploitation, and supplier pressure, evoking anger and disillusionment. Some defend thin margins and note competitive pricing at Leclerc, yet overall fatigue and eroded confidence dominate—shoppers feel squeezed, neglected, and wary of everyday essentials.



Context


EU law requires supermarkets to maintain timestamped temperature monitoring, which is why controllers are internet-connected; 'refrigeration as a service' maintenance models add further connectivity . A similar defrost-tampering incident hit an Israeli food-processing facility in 2025 and US military commissaries in late August 2026 . Attackers reportedly changed freezer settings from -22°C to 150°C near Bordeaux .



Takeaway


This incident shows how regulation-driven connectivity — mandatory temperature logging for food safety — turned mundane appliances into attackable critical infrastructure. Legacy firmware, default passwords, and public IP exposure created cheap, deniable disruption with real economic and food-waste costs. Attribution may never be known, which itself is the lesson: low-cost, high-impact attacks on IoT leave almost no forensic trace, and defense must assume exposure rather than traceability.



Potential Outcomes

ANSSI publishes technical findings identifying the exploited vulnerability and attack path, prompting EU-wide IoT security mandates (Probability: ~55%; falsifiable if no public technical report emerges within months).

No attribution is ever established and the incident fades, with copycat attacks on exposed controllers elsewhere validating SentinelOne's prediction of more incidents (Probability: ~60%; falsifiable if a credible state or criminal attribution is confirmed).





Discussion:



Popular Stories







Balanced News:



Sort By:                     














Build a focused, ad-free news feed.

Create Free Feed