The night the fridges reached 50 °C: what the French supermarket attack means for cold rooms in Spain

On the night of Sunday 11 to Monday 12 October 2026, while the shops were closed, attackers took control of the refrigeration in supermarkets across France. By morning they had forced the temperature of many fridges up to 50 °C, causing fires and food losses at several hundred stores, Reuters reported.⁴

Three weeks later, in the early hours of 2 November, store refrigeration in at least nine more European countries was taken over remotely and switched to defrost.⁵ Spain was not among the countries reported hit.

This article sets out what the authorities and the companies involved have said: what happened, how the attackers got in, and what it means if you run cold rooms, in a cold store, a meat plant, a dairy, a fruit warehouse or a shop. It ends with five questions to put to your refrigeration contractor and your IT provider this week.

One night in October

The attack ran overnight, from Sunday to Monday.² BFM TV, quoted by AFP, reported that the attackers had managed to trigger the forced defrosting of the refrigeration systems remotely.² Les Mousquetaires, which owns Intermarché, said fridges at about 150 of its stores were heated to 50 °C overnight for six hours.⁶

The Paris prosecutor’s office described a “large-scale” attack “affecting connected refrigerators in several major food retailers across France”⁶ and opened an investigation into the damage reported, from food losses to the outbreak of fires.² On 13 October, France’s economy and finance minister, Roland Lescure, told Parliament that about 700 of the country’s 10,000 supermarkets had been affected.¹ The Prime Minister, Sébastien Lecornu, instructed ANSSI, the national cyber security agency, to investigate.⁴

The losses are estimates, and they differ. Intermarché’s chief executive, Thierry Cotillard, told BFM TV that the attack would cause losses of “tens of millions of euros nationwide in a single day”.⁶ Dominique Schelcher, chief executive of Coopérative U, told RTL that a small store could lose a few tens of thousands of euros and a hypermarket 180,000 to 200,000 euros.⁷ INCIBE‑CERT, the incident response team of Spain’s national cyber security institute, put the reported losses at tens of millions of euros.⁸ Intermarché also warned that insurance policies may not “cover this type” of incident in stores.²

How the attackers got in

CERT‑FR, the French government’s computer emergency response team, issued an alert on 12 October, updated on 13 and 16 October, about “nombreuses compromissions”, numerous compromises, of the remote controllers that run refrigeration installations. It also set out a general rule: exposing a management interface on the internet is contrary to good practice.⁹

On 21 October, ANSSI’s director general, Vincent Strubel, told the Senate’s foreign affairs and defence committee that the attackers had exploited “défauts de sécurisation élémentaire”, basic security failures: the direct exposure of refrigeration equipment on the internet, its administration without particular protection, and weak passwords.³¹⁰ Strubel added that the flaws researchers had published in this kind of equipment were not the ones exploited: “ce ne sont pas ces vulnérabilités-là qui ont été exploitées”.³

One supplier of the controls said most of its affected devices were obsolete: they had reached the end of their life and no longer received software or security updates.⁷¹

Why is a supermarket fridge on the internet at all? Its control panels “can be accessed over the internet, enabling maintenance companies to adjust them from anywhere”, ABC News reported.⁶ Researchers at Forescout have measured how common that is: they counted 12,976 internet-exposed service observations across 10 refrigeration product groups, on 6,017 public IP addresses in 99 countries and territories.¹¹ Unless roles are clearly assigned, they warned, “no single party may have complete visibility into the exposed service”.¹¹

Three weeks later, nine more countries

In the early hours of 2 November, store refrigeration in at least nine European countries was taken over remotely and switched to defrost, and shops threw away chilled and frozen food. AFP listed Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden.⁵ NBC News reported six of those countries.¹²

In Belgium, the head of the company that runs one chain’s refrigeration said the units’ evaporators had been switched to defrost mode.¹² The owner of a Belgian butchery chain found the fridges at a store south of Antwerp turned up to as high as 18 °C, and estimated that the incident ruined about €15,000 of meat.¹³ Both early accounts of how it happened point outside the store. One Swedish chain said all its affected stores were connected to an external refrigeration control system, without confirming a cyber attack.⁵ In Portugal, the group behind seven affected stores said the attack appeared to have targeted an external service provider.¹⁴

The EU’s agriculture commissioner, Christophe Hansen, called the attacks “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”.⁵ Belgian federal prosecutors opened an investigation.⁵ Belgium’s Centre for Cybersecurity said: “It is not known who is behind this attack, and it may never be determined.”¹³ Nobody has claimed it.

The counts in this section are as AFP and NBC News reported them, checked on 3 November 2026. The story is still developing, and they may change.

And Spain?

Spain was not among the countries reported hit in either wave.⁵¹⁴ In October, Carrefour España told Escudo Digital that Spain had not been affected “en ningún caso”, in any case, and a spokesperson for Auchan, which trades in Spain as Alcampo, said the group had not been affected in Spain.¹⁵

After the second wave, INCIBE’s 017 helpline said it could not yet determine “ni el vector de entrada ni el alcance del incidente en España”: neither how the attackers got in nor how far the incident reached in Spain.¹⁶

The same report quoted Marcelino Madrigal, a network and security analyst who had found more than 300 refrigeration and air-conditioning devices reachable from the internet in Spain. Madrigal did not try to access any of them. “Exposed is not the same as vulnerable,” Madrigal said; to see that, “I would have to try to get in, and I don’t want to be arrested” (our translation).¹⁶

Five questions for your refrigeration contractor and IT provider

Put them to both at once: unless roles are clearly assigned, neither may see the whole picture.¹¹

1. Can any of our refrigeration controllers, or their management pages, be reached from the internet? CERT‑FR’s first step is to remove that exposure, for the affected units and for every unit on a public IP address.⁹
2. Who connects to them from outside, from where, and with which accounts? CERT‑FR says access should come back only through a secure VPN or a protected network.⁹
3. Have the default passwords been changed, and is the firmware up to date? Both are on CERT‑FR’s list.⁹
4. Is any unit past the end of its life? CERT‑FR warns that leaving equipment without security fixes exposed to the internet means a very high probability of compromise.⁹
5. If someone changed a setpoint or a defrost schedule at 2 am, who would notice, and how fast? In Stockholm, a sales manager at a franchised supermarket told Reuters that the November attack happened at that hour and was only noticed hours later.¹³

Start with the way in