Facts current as of 10:20 a.m. ET, Nov. 3, 2026.
The short version: Attackers remotely forced supermarket refrigeration into defrost in France on the night of Oct. 11–12, 2026, and a second wave hit the night of Nov. 1–2. By Nov. 3, AFP (Agence France-Presse) was reporting cases in at least 11 countries. Nobody has claimed responsibility. Officials have pointed to basic security gaps but haven't given a full account of how the attackers got in.
Picture a supermarket manager getting a 4 a.m. call: the company that monitors the store's refrigeration says temperatures are climbing. By the time the manager gets the doors open, there's water pooled under the cases, the meat and dairy are warm, and the stock is headed for the dumpster. Nobody inside the store touched a thing.
That's close to what was reported in France last month. NPR spoke with a manager near Dijon who got that kind of 4 a.m. call (NPR), and staff at other stores arrived to find pools of water and spoiled food (CNN). On the night of Oct. 11–12, 2026, attackers remotely forced refrigeration in French stores into defrost mode, and France's finance minister told lawmakers that about 700 food stores were affected (BFMTV). Intermarché said some of its units ran at about 50°C (122°F) for around six hours (BBC).
A second wave hit on the night of Nov. 1–2. SecurityWeek counted more than 100 stores across Europe (SecurityWeek), and by Nov. 3, AFP was reporting cases in at least 11 countries, including Belgium, Germany, Italy, Romania and Sweden (AFP). Belgium was hit hardest, with at least 76 sites, according to Belgian press reports (DR). Meanwhile, the UK's National Cyber Security Centre (NCSC-UK) said it knew of "a couple of instances" in the UK (BBC). Nobody has claimed responsibility, officials haven't said who did it, and prosecutors in France and Belgium are investigating.
What the attackers actually did
Store refrigeration is run by a controller, a small computer that sets temperatures, defrost schedules and alarms. Most controllers have a management interface, a login page that lets a technician check and change those settings from a web browser. With working access, hackers would be able to control the refrigeration equipment and jack up the temperature to ruin the food.
How we think they got in (our speculation)
Officials haven't given a full technical account, but France's national cyber agency and Italy's government have both described what they found. Beyond that, what follows is MQUAL's informed guess. These are the paths we'd check first, and more than one may have been involved.
The likeliest starting point is controllers reachable from the open internet. "Exposed to the internet" means anyone, anywhere, can pull up the login page. CERT-FR, France's national cyber response team (a CERT is a government team that warns organizations about attacks and helps them respond), named the following refrigeration controllers as being affected by this hack: Danfoss AK-SM and AK-SC, as well as Copeland and Dixell XWEB controllers. It said exposing management interfaces to the internet goes against best practice (CERT-FR). Belgium's national cyber agency had issued a similar warning on Oct. 13 (CCB). On Nov. 3, Italy's government said the affected Italian outlets mostly had "outdated security systems, with interfaces exposed directly to the internet and weaknesses in authentication mechanisms" (Italian government). That matches what the head of France's national cyber agency, ANSSI, told French senators on Oct. 21, according to Le Parisien: the French attacks exploited "basic security failures, starting with refrigeration equipment exposed directly to the internet and managed without any particular protection, weak passwords" (Le Parisien).
Old software is our second suspect. Danfoss said most of the affected units in France were end-of-life, meaning the manufacturer no longer releases security fixes for them, or were running out-of-date built-in software (Cooling Post). Security researchers had published flaws in some of these controllers, but France's cyber agency said those weren't the flaws that were exploited. After the November wave, Danfoss confirmed its products were involved again (Børsen), and Danish news agency Ritzau reported that several affected systems were on outdated software. Reports point to stores' installed equipment being compromised; there's no public evidence the manufacturers' own systems were breached.
Weak passwords are more than a possibility. Equipment like this often ships with a factory password, and if nobody changes it, a stranger who finds the login page may type it in. SecurityWeek reported that a security firm saw login attempts using publicly documented factory passwords on decoy Danfoss systems in late October. France's cyber agency cited weak passwords, and a Danfoss spokesperson told Dutch broadcaster NOS that the Dutch systems hit in November weren't on a secure network and still used a default password (NOS).
Finally, there's the contractor's login. Refrigeration is often serviced by an outside company that connects remotely. In Portugal, Intermarché's group said the attack "appears to have targeted an external service provider responsible for managing the refrigeration systems" (BBC). A single stolen technician login could, in theory, reach every store that contractor manages.
Takeaways for your business
You may not own a freezer case, but you likely have equipment that works the same way. Thermostats and HVAC systems, door access panels, security cameras, medical and vaccine fridges, and warehouse cold storage have their own controllers and login pages, often set up by a contractor for remote access. Internet-scanning firm Censys ranked the U.S. among the top countries for exposed Danfoss store-management interfaces, according to SecurityWeek. The U.S. Cybersecurity and Infrastructure Security Agency (CISA), NCSC-UK and equipment makers recommend the following:
- Find what's reachable from the internet. List every building, HVAC and refrigeration controller. Don't assume it's offline; verify it, and take anything exposed off the public internet.
- Change default passwords to strong, unique ones.
- Make contractors connect safely. Require a VPN (an encrypted private connection into your network) with MFA (multi-factor authentication), which asks for a second proof, such as a code on a phone.
- Patch what's supported, and replace what isn't. Update units that still get fixes, and plan to replace end-of-life ones.
- Keep this equipment off the office network. Network segmentation puts building systems on their own separate network, so a problem there can't easily reach the computers holding your patient, client or financial records.
- Make sure overnight alarms reach a person who will actually get up and respond.
Supermarket fridge attacks FAQ
What happened to the supermarket fridges in Europe? On the night of Oct. 11–12, 2026, attackers remotely forced refrigeration in French stores into defrost mode, and staff at some stores arrived to find pools of water and spoiled food. A second wave hit on the night of Nov. 1–2, and by Nov. 3, AFP was reporting cases in at least 11 countries. Belgium was hit hardest, with at least 76 sites, according to Belgian press reports.
Who was behind the attacks? Nobody has claimed responsibility, officials haven't said who did it, and prosecutors in France and Belgium are investigating.
How did the attackers get in? France's cyber agency blamed basic security failures, such as internet-exposed equipment and weak passwords, and Italy's government said much the same about its cases. Beyond that, the possible paths in this post are MQUAL's speculation. We think the likeliest starting point is controllers reachable from the open internet, with old software, factory passwords or a contractor's remote login as other possible paths.
Were the refrigeration equipment makers hacked? There's no public evidence of that. Reports point to stores' installed equipment.
What should a U.S. business check? Thermostats and HVAC systems, door access panels, security cameras, medical and vaccine fridges, and warehouse cold storage have their own controllers and login pages, often set up by a contractor for remote access. CISA, NCSC-UK and equipment makers recommend the same basics: find what's reachable from the internet, change default passwords, make contractors connect through a VPN with MFA, patch what's supported and replace what isn't, keep this equipment off the office network, and make sure overnight alarms reach a person.
Not sure what's connected in your building? Talk to MQUAL
MQUAL is a boutique IT engineering and managed IT firm in Clearwater, Florida. We were founded in Philadelphia in 2006 and have served businesses across the U.S. since then. If you're not sure what's connected in your office, clinic or warehouse, book a 15-minute discovery call or call us at 844-724-8251. We'll talk through what you have and what to check first, no pressure. You can also read more about our cybersecurity services.
This post is based on public reports as of Nov. 3, 2026. Our view on how the attackers got in is speculation. Details may change as investigations continue.
Related reading
- Think Cybersecurity Is Just IT's Job? Think Again.
- Binance Hack: $6.3 Billion Theft Explained in Plain English
- Cybersecurity protections every warehouse should have