What happened

Unknown attackers got into the refrigeration controllers of several hundred French supermarkets, among them stores of Intermarché, Netto, Coopérative U and Carrefour. They put the evaporators into defrost in the middle of the night. The cases warmed up, to around 50 °C in some stores, and in several places equipment melted or caught fire. Whole aisles of chilled and frozen food had to be thrown away.

Nobody noticed in time, because the controllers raised no alarm. They were simply doing what they had been told. Stores in Belgium soon reported the same, and in early November refrigeration in stores in Sweden, Belgium and Luxembourg, among other countries, was hit again.

How they got in

The controllers that were hit were connected straight to the internet, with a built-in web page for remote control. Security researchers had shown in 2025 that on a widely used model, the login could be bypassed with a service code based on the date. The manufacturer, Danfoss, fixed the flaw in an update in August 2025 and urged customers to update or replace older controllers. The systems that were attacked were running outdated software, and some of the models had not been updated for years.

So this was not a sophisticated attack. What made it possible was old controllers left open on the internet, and updates that had not been installed.

Refrigeration is critical infrastructure

Refrigeration keeps food and medicine safe, and a supermarket without it cannot sell a large part of what it stocks. That is what makes it a target: one attack hits many stores at once, the cost is immediate, and customers feel it. The EU’s NIS2 directive counts the production, processing and distribution of food among the critical sectors, and after the attack the EU commissioner for agriculture and food said that food security needs more attention at every level.

Refrigeration is often looked after by an outside contractor, and the controller usually has remote access so the technician can check the system from anywhere. That is convenient, but it also means security depends on how that access is set up, and whether anyone is keeping an eye on it.

How to protect your refrigeration

  • Ask your refrigeration contractor for a list of every controller, with its model and software version
  • Update the controllers, and replace those the manufacturer no longer updates
  • Take the controllers off the open internet, and make remote access go through a secure connection such as a VPN
  • Change default passwords, and give every user their own login
  • Agree who has remote access, and close any access that is not used
  • Keep the refrigeration network apart from the rest of the store’s network and from guest Wi-Fi
  • Have monitoring that does not depend on the controller, so you are told when the temperature rises, whatever the cause

Most of these are jobs for your refrigeration contractor. Ask them directly where your stores stand.

How Maci Intelligence spots an attack

Maci Intelligence is built to see what is really happening in the system, even when the controller has been tampered with. Maci has its own sensors on the system and does not read from the controller. Temperature, pressure and current are measured every minute. If an evaporator is put into defrost in the middle of the night, Maci sees the temperature rise and the compressor stop, and sends an alert by SMS and email while there is still time to save the stock. If nobody takes the alert, it goes to the owner after 15 minutes. If a Maci unit loses its connection, you are told about that too.

Maci sends no commands to the system and cannot change its settings. In other words, Maci does not add a new way into your refrigeration.

Encrypted and secured to an industrial standard

  • Every Maci unit has its own digital certificate, and its connection to Maci is encrypted
  • Readings are encrypted all the way and stored encrypted in the EU
  • Nobody logs in with a password: sign-in is with a passkey, Google or a one-time code
  • The owner decides who can see each system, and access is checked on every action
  • Admin actions are logged

See how Maci Intelligence works

Sources

  • Reuters, CNBC and CBS News on the attacks on supermarkets in France and Belgium, October 2026
  • DR (Danish Broadcasting Corporation): Danfoss on the hacking of French supermarkets, 14 October 2026
  • TV 2 (Denmark): freezers and fridges hacked in several European supermarkets, 2 November 2026
  • Claroty Team82 on vulnerabilities in the Danfoss AK-SM 800A, 2025
  • The NIS2 directive, (EU) 2022/2555, Annex II

How the alerts reach you is on our page about alerts, and how we look after data is on our page about data security.