Most cyberattacks steal data. This one spoiled food. It is one of the clearest examples yet of a cyber-physical attack on everyday infrastructure, and a warning for every retailer, warehouse and cold chain operator in the world.
1. What happened?
On Monday 12 October 2026, major French food retailers confirmed that their refrigeration systems had been hit overnight. Coopérative U's chief executive called the attack "unprecedented" [1][4]. The Paris prosecutor's office confirmed a large-scale attack on connected refrigerators that led to food losses and fires [3][4].
1.1 Which chains were affected
The exact numbers vary between outlets and were still changing during the day. The table shows the figures as each source reported them.
| Retailer | Stores reported affected | Source |
|---|---|---|
| Intermarché / Netto | 150 to 300 (plus about 100 disconnected as a precaution) | [1][2][4] |
| Coopérative U | About 100 or more | [1][4] |
| Carrefour | About 80 | [4] |
| Monoprix | About 30 | [4] |
| E.Leclerc | Several stores | [1] |
Affected branches had to "throw away all of the products" that were fresh and frozen, Intermarché said [1]. The losses are estimated in the millions of euros [2].
1.2 How the attack worked
The attackers did not break into the stores' IT networks. They went after the software retailers use to manage their cold units remotely, supplied by the Danish manufacturer Danfoss [1][2].
Supermarket freezers normally defrost briefly at night, and temperatures rise a little. According to BFM TV, the hackers "managed to remotely trigger the forced defrosting of the refrigeration systems" [1][4]. The BBC reports that units were ordered to heat up and stay hot, some reaching 50°C overnight according to one chain [2].
Danfoss said the affected units were older models whose security software could not be updated to address a risk it had identified, and that it had "long advised" customers to keep supported systems up to date [2].
1.3 Official reactions
"Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is extremely serious and is unprecedented. It is unacceptable."
Dominique Schelcher, CEO of Coopérative U [4]
"Food security requires more attention at all levels."
Christophe Hansen, EU Commissioner for Agriculture and Food [1]
2. Why did it become so big?
The attack itself was simple. What made it a disaster was that nothing around the refrigeration system was able to see it, confirm it or react to it.
2.1 One system controlling and reporting
In most stores, the refrigeration controller both runs the cold units and reports their temperature. Once it is compromised, it can keep cooling off and keep the alarms quiet at the same time. There is no second opinion.
2.2 Energy that nobody watches
Heating elements running all night draw a very unusual amount of power. In most chains, though, electricity is only checked on the monthly bill. The signal was there, but no one was looking.
2.3 A manual field response
Even when a problem is spotted, someone still has to call a technician, find the right store and explain the issue. At night, that can take hours. By then the stock is already lost.
3. An end-to-end defence: detect, confirm, decide, act
The lesson is not "buy one more security tool". It is to connect independent signals so that a problem is caught, confirmed and handled in minutes, even if one system is lying.
3.1 WorkySens detects
Independent wireless temperature probes sit inside the cabinets and send data over their own network, separate from the refrigeration controller. If the controller is taken over, the probes still report the real temperature, and an alert fires within minutes of a threshold being crossed.
3.2 WorkyEtta confirms
Meters and analysers in the electrical panel show, in near real time, that heating elements are drawing power far beyond a normal defrost cycle. This is a second, independent proof that something is wrong.
3.3 WorkyCore decides
The platform puts the two signals together: rising temperature plus abnormal energy use in the same store at the same time. That combination rules out a faulty sensor, and the store is flagged as a top priority incident.
3.4 WorkyField acts
A work order is created automatically and sent to the nearest on-call technician or subcontractor, with the store, the cabinets and the readings attached. Arrival and resolution are tracked against a service level target.
4. The same night, a different outcome
5. A five-step checklist for retailers
- Find your connected controllers. List every refrigeration and building controller reachable from the internet, and note which ones can no longer be updated.
- Add an independent temperature layer. Do not rely only on the controller to report on itself.
- Watch energy, not just bills. Near real-time metering turns unusual power use into an early warning.
- Connect alerts to action. An alert should create a work order automatically, not wait for someone to read an email.
- Keep a trustworthy record. Time-stamped temperature and response logs support food safety checks and insurance claims.
Conclusion
The French attack shows that a fridge is now part of the attack surface. Patching old controllers matters, but it is not enough. What protects a store is a chain of independent checks that ends with a person on site, fast.
Sources
All sources published on 12 October 2026. Figures differ between outlets and are given as reported.
- AFP: French supermarkets suffer refrigerator shutdown after 'unprecedented' cyberattack
- BBC News: Fridges in French supermarkets hit by cyber attack
- The Guardian / Reuters: Hackers force French supermarket fridges to heat up to 50C in 'unprecedented' cyber-attack
- France 24: 'Unprecedented' cyberattack targets refrigeration units at hundreds of French supermarkets
- CNET: Cyberattack Targets French Supermarket Refrigerators, Forcing Mass Food Disposal
- CBS News: Hackers turn up the heat in refrigerators at hundreds of supermarkets in France