Skip to content

Episode 10

How Did Hackers Heat Up Supermarket Freezers?

Hackers heated French supermarket freezers to 50 °C without touching them. The trick: a defrost heater every freezer has, and controllers left online.

4 November 20266 min readVideo 8:19

A hacker can heat up a supermarket freezer because every freezer already has a small heater inside, used to melt frost, and a controller decides when it runs. Many of those controllers were put on the open internet so refrigeration contractors could manage them from anywhere, some behind weak passwords and on old models that no longer get fixes. Switch the freezers into defrost from outside, leave them there, and the food cooks.

Watch the episode: Someone Hacked the Supermarket Freezers 8:19

Chapters

The night the freezers got hot

The attack ran overnight from Sunday to Monday, 11 to 12 October 2026. Fridges and freezers in French supermarkets were forced up to 50 °C, and nobody in the shops touched them. Some units reached up to 80 °C for several hours.

By Monday, Intermarché said its affected branches would have to throw away all their fresh and frozen products, and warned that insurance may not cover this type of in-store incident. Carrefour counted 80 of its supermarkets hit, Monoprix around 30, Coopérative U almost 100, and Intermarché some 150 to 200. Carrefour added that the vast majority of its 6,000 stores were not affected.

France's finance minister, Roland Lescure, put the total at about 700 of France's 10,000 supermarkets. Coopérative U's chief executive, Dominique Schelcher, called it extremely serious and unprecedented. The Paris prosecutor's office called it large-scale, and Prime Minister Lecornu ordered France's cyber agency, ANSSI, to investigate. For the freezers.

Why does a freezer have a heater?

A freezer makes its own frost. Frost and ice build up on the evaporator coil and block the air the freezer needs to cool. So freezers use a small heater in the evaporator to melt it off. That is defrost.

In a home frost-free freezer, the heater runs on a timer, typically once or twice a day. The short run is the whole point, because if a defrost cycle runs too long, it adds heat to the box. Run it all night and you have built an oven with a glass lid.

That is what happened. Hackers remotely triggered forced defrosting of the refrigeration systems in France, and in Belgium the units' evaporators were switched to defrost mode. Nothing was broken. A heater built to melt a little frost was switched on and left on, with the food still inside.

Why is a supermarket freezer on the internet?

In a supermarket, the defrost is set by a controller. Danfoss's AK-SM 800A, for example, is a system manager that coordinates the refrigeration controllers across a whole site, with a web page for setting temperature thresholds and schedules. One login to that box reaches every fridge and freezer in the shop.

It is online because the chains outsource their refrigeration to contractors. Those contractors manage the controllers over the internet: they adjust temperatures, clear alarms and change defrost cycles without driving to the store. It saves a lot of driving. It also puts the defrost button on the internet.

A contractor's login has opened a shop before. In 2013, hackers got into Target's network using network credentials stolen from Fazio Mechanical, its refrigeration and HVAC contractor. Fazio said the connection was only for billing, contracts and project management. The breach exposed about 40 million debit and credit card accounts. Nobody has said that is what happened in France.

France's cyber emergency team, CERT-FR, said it knew of numerous compromises of remote refrigeration controllers: Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb. It warned the campaigns were probably still going on. Claroty had counted 2,765 AK-SM 800A devices exposed online. After the attack, Reuters found at least 4,500 Danfoss interfaces still visible, and a French scanning company, Onyphe, said only a small minority appeared to run the latest software.

The back door nobody needed

In August 2026, Claroty's researchers found a hidden password in the Danfoss AK-SM 800A, generated from the device's date and time. With it, an attacker could get administrative access to the web management page. It was one of three vulnerabilities they reported (CVE-2025-41450, -41451 and -41452), and Danfoss had released firmware R4.3.1 to fix them.

So it was tempting to assume that was the way in. On 21 October, ANSSI's head, Vincent Strubel, told the Senate otherwise. He dismissed analyses linking the attack to the disclosed flaws and blamed basic security failures and weak passwords: refrigeration equipment exposed directly on the internet, run without any particular security. Researchers had found a secret back door. According to France, the attackers used the front one.

Danfoss said most affected systems were older products that no longer received security updates. CERT-FR warned that keeping an end-of-life device online makes compromise very likely, even after a factory reset. And ANSSI has no power to force supermarket chains to secure their systems, although it has published a guide to securing industrial systems since 2014. Ken Munro of Pen Test Partners called it a matter of basic cyber hygiene.

Then it spread beyond France

France was not even first. In August, freezers at a market in Fort Huachuca, an Army base in Arizona, went into defrost mode, and the naval station in Newport, Rhode Island, said its refrigeration was affected too. Reuters, citing four officials, reported that the Pentagon considered the base malfunctions a suspected hack.

On 2 November, fridges and freezers at more than 100 shops in several European countries ran hot: Sweden, the Netherlands, Belgium, Ireland, Luxembourg and Estonia.

Where	What was reported
Belgium	Carrefour: 15 of its more than 700 stores; an IKEA site in Mons
Ireland	Musgrave: refrigeration in 13 SuperValu stores
Sweden	An ICA Kvantum store in Sjöbo said it was hacked and set to 122 °F (50 °C); Coop: six stores
Estonia	Temperature turned up to 122 °F

A Belgian butchery chain's store in Hove, south of Antwerp, saw its fridges reach 18 °C and lost meat worth about 15,000 euros. Sweden's cyber security centre said the country has quite a lot of exposed operational technology devices, which is not a phrase you want from a cyber security centre.

No one has claimed the attacks, and authorities have not said who was behind them. Belgium's prosecutor's office opened a criminal investigation. EU Commissioner Christophe Hansen called it a deliberate attempt to disrupt the EU's food supply, while saying food security is not currently at risk; the waste and the cost to businesses are real. Strubel also warned that the same kind of equipment is used in health, down to pharmacies that store vaccines, and ANSSI intervened urgently to check it.

What to notice next time you buy frozen food

The fix is as basic as the failure. CERT-FR told owners to take the controllers off the internet and reach them only through a secure VPN or protected network, and told Danfoss owners to set the security level to Strict and change default passwords. Get it wrong, as Ken Munro put it, and you get a smelly mess of defrosted food.

Next time you reach for frozen peas, see if the case has a temperature display. In the EU, quick-frozen food must be kept at -18 °C or colder.

And a question for you: what's the oldest thing in your home that's still connected to the internet?

Sources

Watch next

Episode 118:22Why Do Petrol Prices Change So Many Times a Day?German petrol stations changed prices 22 times a day. A noon rule cut that to 6 or 7, and margins rose. Here is why stations keep watching each other.