Summary: A cyberattack on French supermarket refrigeration systems in October 2026, facilitated by unpatched devices, heated fridges to 50°C, spoiling food and costing retailers tens of millions of euros. The root cause: outdated firmware on connected devices that nobody patched. The lesson for enterprise security teams is simple — unpatched, forgotten devices are the easiest door in, and awareness training needs to cover them, not just phones and laptops.

Hundreds of French supermarkets didn’t see this one coming. Overnight on October 11-12, 2026, attackers pushed refrigeration and freezer systems at major retailers up to 50°C, spoiling food and triggering fires in some locations (Reuters, Oct 12, 2026). At least 350 stores were affected, according to Reuters and NBC News reporting from October 13. Intermarché alone had roughly 150 stores hit, with fridges running hot overnight for six hours. CEO Thierry Cotillard put the damage at “tens of millions of euros nationwide in a single day.” Carrefour reported 80 supermarkets affected. Coopérative U’s CEO, Dominique Schelcher, said losses ranged from several tens of thousands of euros in a small store to €200,000 in a larger hypermarket.

This wasn’t a sophisticated, headline-grabbing exploit. It was a known, wide-open gap.

What actually caused the French supermarket fridge attack?

France’s national cybersecurity agency, ANSSI, traced the vulnerability to software from Danfoss, the Danish company that makes the control systems running those cold aisles. Danfoss confirmed the affected units “were running outdated firmware” and that many had “reached end of life and no longer receive software or security updates.” The company said it had “long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions.”

Here’s the part that should sting: Claroty’s Team82 published research on vulnerabilities in the Danfoss AK-SM 800A controller back on August 9, 2026 — two months before the attack. The fixes existed. Nobody applied them in time.

Ken Munro of Pen Test Partners summed it up bluntly: “This is about basic cyber hygiene… Get it wrong, and you get a smelly mess of defrosted food.” Using Shodan, Reuters found at least 4,500 Danfoss interfaces still viewable on the open internet as of October 13. A French scanning firm, Onyphe, found that only a small minority were running the latest software.

Why do employees patch their phones but not their smart devices?

Think about your own habits for a second. Your phone nags you to update. Your laptop forces a restart. Your banking app won’t even open until you’re current. But what about the smart thermostat in the breakroom? The networked printer in the corner? The security camera nobody’s logged into since installation day?

That gap isn’t new, and it isn’t limited to supermarkets:

• In the 2013 Target breach, attackers got in through credentials stolen from an HVAC contractor — a third-party vendor connected to the network for routine maintenance. The result: roughly 40 million payment cards and 70 million customer records exposed, according to a U.S. Senate Commerce Committee analysis.
• The Mirai botnet turned ordinary IoT devices — cameras, routers — running default credentials into an army that knocked major websites offline in 2016.
• Reuters also reported similar refrigeration disruptions at about a dozen U.S. military commissaries in late August 2026.

The pattern repeats because the devices people forget are the devices attackers remember.

How can security awareness leaders close the “forgotten device” gap?

You don’t need a bigger budget. You need sharper focus. Here’s where to start:

1. Build a real asset inventory. You can’t patch what you don’t know exists. Map every connected device — not just laptops and phones.
2. Add a “forgotten device” module to your training. Teach employees to treat smart TVs, printers, and IoT gear with the same suspicion as their inbox.
3. Extend awareness home. Family routers, smart fridges, and baby monitors run on the same lax habits. Protecting the household protects the employee.
4. Kill default passwords. Every connected device, every time, before it touches your network.
5. Retire end-of-life equipment. If a vendor stops issuing patches, that device is now a liability, not a tool.
6. Assign vendor and OT patching ownership. Someone specific, not “IT in general,” should own this.
7. Keep content short and current. A two-minute piece tied to this week’s news beats a 40-minute annual module every time.
8. Track engagement, not just completion. Opens, shares, and quiz scores tell you what’s actually landing.

Eurocommerce’s Christel Delberghe called the French incident a reminder of “the importance of resilience across the entire supply chain.” Your supply chain includes every forgotten smart device plugged into your network — and every employee who doesn’t know it’s there.

Aware Force builds exactly this kind of content: short, branded, newsroom-style cyber awareness that covers the devices employees actually forget, not just the ones they already patch. Talk to us about adding a forgotten-device module to your program.

FAQ

What caused the French supermarket cyberattack?
ANSSI identified a vulnerability in Danfoss refrigeration control software. Affected units were running outdated firmware, many past end-of-life support, and were accessible over the internet.

How many stores were affected?
Reuters and NBC News reported at least 350 stores as of October 13, 2026, across retailers including Intermarché, Carrefour, Monoprix, and Coopérative U. The New York Times reported more than 400.

Was this attack linked to a specific group or nation?
No group claimed responsibility, and no ransom demand was made public. Attribution has not been confirmed.

What’s the main risk for enterprises?
Forgotten or rarely-touched connected devices — IoT equipment, smart appliances, vendor-managed controllers — often run outdated software because they’re excluded from routine patching habits.

What should security awareness training include to prevent this?
A forgotten-device inventory, default-password elimination, clear vendor patching ownership, end-of-life retirement policies, and short recurring content tied to real incidents.

Sources: Reuters, BBC,