Sometime overnight on October 11 into October 12, 2026, hackers took remote control of refrigeration systems inside hundreds of French supermarkets and forced the units into continuous heating cycles. By Monday morning, store managers across France were walking into aisles of ruined meat, liquefied ice cream, and spoiled dairy. In at least a few locations, the overheated equipment sparked fires. The Paris prosecutor’s office called it a large-scale cyberattack affecting connected refrigerators in several major food retailers across France. By late October, the Pentagon confirmed it was treating similar freezer malfunctions at US military bases as a suspected hack.

What Happened Inside the Stores

Refrigeration control panels in modern supermarkets manage an entire store’s cold cases from a single interface, accessible over the internet. That remote access is designed for maintenance convenience, allowing technicians to adjust settings from anywhere. The same feature allowed attackers to push temperature settings on targeted units to 50 degrees Celsius (122 degrees Fahrenheit) and hold them there for roughly six hours overnight.

The attack exploited a known vulnerability in older firmware running on refrigeration controllers manufactured by Danish engineering firm Danfoss. Rather than simply shutting the units down, the attackers manipulated the defrost function. Freezers normally run brief defrost cycles to prevent ice buildup; the hackers extended and intensified that process until the units became ovens.

Danfoss confirmed it was aware of incidents in France affecting a limited number of refrigeration management systems and stated that the affected units were running outdated firmware. The company added that it had long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions.

On August 9, 2026, cybersecurity firm Claroty’s Team82 had published research detailing specific vulnerabilities in the Danfoss AK-SM 800A controller. According to that report, the identified issues could have allowed attackers to bypass authentication controls and execute code on compromised devices. Firmware updates addressing those issues had been released, but a gap between releasing an update and getting every affected operator to install it left a window of exposure that this attack apparently walked straight through.

The Scale of the Damage

Les Mousquetaires, owner of the Intermarché chain, confirmed fridges at around 150 of its stores were heated to 50 degrees Celsius for six hours. A spokesperson said all affected food had been discarded to eliminate health risks. The BBC reported 180 stores from Intermarché and its Netto brand were affected, with another 100 stores urgently disconnected from the internet as a precaution.

Coopérative U CEO Dominique Schelcher confirmed his chain was also targeted. Carrefour said 80 of its supermarkets were hit. Monoprix reported 5 percent of its stores were affected. Cybersecurity analyst Felix Aime of Sekoia Threat Detection and Research said the attack extended beyond France, with Spain, Portugal, Poland, Germany, and Belgium also affected.

Reuters reported that Paris resident Geert de Clercq watched Intermarché staff in central Paris wheel cartfuls of defrosted frozen food into a giant trash container, with melted ice cream running onto the street. In Haguenau, in northeastern France, two supermarkets alone reported losses of 270,000 euros. Intermarché CEO Thierry Cotillard told BFM TV the attack would represent losses of tens of millions of euros nationwide in a single day. The BBC put the total number of affected stores across all chains at roughly 400 out of approximately 15,000 in France.

European Food Commissioner Christophe Hansen condemned the attack and posted on X: “Food security requires more attention at all levels. Because the weaponisation of food has become a reality.”

French Prime Minister Sebastien Lecornu instructed France’s National Cybersecurity Agency (ANSSI) to investigate. ANSSI identified the Danfoss software vulnerability as the entry point. France said it was coordinating with European counterparts because other countries could also be affected.

The Pentagon Connection

What makes the French attack harder to dismiss as an isolated criminal episode is what was happening on the other side of the Atlantic two months earlier.

In late August 2026, freezer malfunctions spoiled food at at least six commissaries on US military bases. Commissaries are on-base stores where military personnel buy groceries. A Reuters review of Facebook posts and website updates from the affected bases confirmed the timeline. At Fort Huachuca in Arizona, the base’s Facebook account explained on August 26 that its freezer went into defrost mode where it heated up all the food.

By late October, Reuters reported that four officials familiar with the matter confirmed the Pentagon was treating those malfunctions as a suspected hack. The US Department of the Army Criminal Investigation Division said its Cyber Field Office was involved in the investigation and was working with French law enforcement to better understand the refrigeration outages in Europe. A unit of US Cyber Command was described as working in close coordination with interagency and law enforcement partners, though the Pentagon declined to elaborate.

Reuters noted that in at least one of the US cases, the cooling units’ temperatures were cranked up overnight rather than simply failing, producing mounds of wilted or melted food by morning. That behavior matches the French attack pattern precisely.

No attribution for either incident had been confirmed publicly as of the time of reporting.

A Known Vulnerability, a Slow Response

The Claroty Team82 research published in August laid out the technical exposure clearly. Both Danfoss and rival manufacturer Copeland had security weaknesses identified in their refrigeration controllers. Both released firmware updates. The French attack demonstrated that a significant portion of the installed base had not applied those updates, whether because operators were unaware, because replacing legacy hardware is expensive, or because equipment that appears to be running normally does not prompt urgency.

Supermarket refrigeration systems, warehouse cold storage, and food-processing facilities all rely on the same model of internet-connected control panels. The convenience of remote management is built into the design. So is the attack surface that convenience creates. Passwords go unchanged, software goes unpatched, and remote access credentials installed years ago by a maintenance contractor may still be active.

Christel Delberghe, director general at European retail association Eurocommerce, said the incident underlines the importance of resilience across the entire supply chain. That framing points to a question that neither retailers nor regulators have fully answered: who is responsible for ensuring that the firmware on a supermarket freezer controller is current, the store, the refrigeration contractor, the manufacturer, or a regulator?

Food as a Target

This attack did not steal data or demand a ransom. It destroyed food. That is a different category of harm than most cyberattacks produce. The disruption was physical, visible, and immediate, and it affected a resource people depend on daily.

The parallel incidents in France and at US military bases, separated by roughly six weeks, raise a question investigators have not yet answered publicly: were these coordinated, or did the French attack inspire copycat behavior against a known-vulnerable class of hardware? The Pentagon’s decision to contact French law enforcement suggests investigators see a connection worth examining.

Whether or not a confirmed link emerges, the events point to a gap in how critical food infrastructure is secured. Retailers across Europe and the United States depend on internet-connected equipment running software that, in some cases, cannot be updated to address known flaws. The attackers in France did not need to be sophisticated. They needed access to outdated systems that were never hardened after their vulnerabilities were publicly documented.

This article draws on reporting from Reuters, BBC News, Activist Post, and Reuters (Pentagon investigation).

Want to go deeper? Ask NEX, the Decrypted Matrix research assistant, about the documents behind this story. It indexes every article here the day it is published and cites its sources.