Update, 2 November 2026. During the night of 1 to 2 November, a new wave of incidents hit supermarkets in several European countries. In Belgium, Delhaize reported an incident affecting the refrigeration systems of around forty stores in Belgium and Luxembourg. Carrefour Belgium reported 15 stores affected. Stores were also hit in Ireland, Sweden and Estonia. The method described is the same: evaporators remotely switched to defrost mode. The equipment does not all come from the same manufacturer. To date, nobody has claimed these attacks and no official link has been established with the French wave. Several operators limited the damage because their alarms warned them during the night. The advice in this article still applies.

Monday 12 October 2026: in hundreds of French supermarkets, the staff opening the store find their freezers lukewarm, the refrigerated displays warm, and cold rooms overheating. Meat, dairy, frozen food: entire aisles end up in the bin. For a store manager, there is nothing worse. The lost stock, the empty shelves in front of customers, the teams pulled in to sort and clean, the questions from the insurer, and that overwhelming sense of injustice.

This article looks back at what happened, at what anyone can check in their own store, and at how we design secure cold chain monitoring.

What happened

During the night of 11 to 12 October, hackers took remote control of the controllers that run the refrigeration systems of many stores. They triggered forced defrost cycles and pushed temperatures up to as much as 50 °C, for about six hours (according to Les Mousquetaires group).

The French Minister for the Economy reported around 700 stores affected. Several chains were hit: Intermarché and Netto, Coopérative U, Carrefour, Monoprix, E.Leclerc. The Paris prosecutor's office also reported fires breaking out.

Losses vary widely with store size. The chairman of Coopérative U estimates them at a few tens of thousands of euros for a small store and up to €200,000 for a hypermarket.

To date, nobody has claimed the attack and its authors have not been identified. A criminal investigation is under way.

Why it was possible

The attack did not target the tills or customer data, but the equipment that manages refrigeration. Three factors come up in every analysis.

Interfaces reachable from the Internet. To make remote maintenance easier, the management interfaces of some controllers could be reached directly from the Internet. They were therefore within reach of anyone, not just the refrigeration engineer.

Equipment that no longer receives updates. According to the manufacturer, most of the affected units were older, end-of-life models for which no security fixes are published any more. The others were running software that had not been updated.

Poorly protected maintenance access. Specialists point to weak protections, such as default credentials that were never changed.

Several experts described the attack as unsophisticated. That is exactly what is worrying: it can be repeated. And this type of connected controller is used in stores well beyond France.

What to do if your store uses this type of equipment

There is no need to panic, and no need to act alone. These questions are best handled with your refrigeration engineer and, where relevant, your franchisor. Here is what it is reasonable to check.

  1. Know what you have. Ask your refrigeration engineer for the make and model of your controller, its software version, and whether it still receives security updates.
  2. Know who accesses it, and how. Can the interface be reached from the Internet? How does your maintenance company connect remotely?
  3. If the equipment is no longer supported, plan its replacement. The French cybersecurity agency is clear: a simple reset is not enough, the device remains vulnerable and is likely to be compromised again.
  4. In the meantime, isolate it. No direct exposure to the Internet. Remote access only through a secure connection (VPN) with two-factor authentication, restricted to known addresses.
  5. Change default passwords on every connected device in the store.

Replace or isolate: there is no third way for a device that will never be patched again.

The blind spot

One detail of this attack deserves attention. The compromised system was also the one that was supposed to monitor temperatures and raise the alarm.

The result: six hours of overheating, discovered when the store opened.

It is an old principle in security: you do not ask a system to monitor itself. An independent witness, measuring on its own side and alerting through its own channel, keeps working even when the monitored installation is compromised.

Our approach: separation by design

This is the choice we made at Enthalpic. Our sensors are self-contained: they run on battery and communicate over their own cellular network. They connect neither to the store's network, nor to the controller, nor to the refrigeration unit.

They are read-only. They cannot change a setpoint, start a defrost or alter a setting. There is simply no path that would allow this to be done through them. Their role is to measure, to provide continuous monitoring of temperatures, to send SMS alerts, and to analyse the cycles of the refrigeration unit to spot drifts and irregularities before they turn into breakdowns.

In a situation like that of 12 October, the temperature rise would have been reported during the night, not discovered at opening time.

This independent witness does not measure exactly the same thing as the controller, and that is deliberate: why the two never show the same temperature.

Let us be clear about what we offer. Our sensors do not provide every function of a connected control system: they control nothing, do not schedule defrosts and do not replace the installation's local control.

Depending on needs, they play one of two roles. For some stores, they replace remote supervision (temperature tracking, alerts, history) for a fraction of the cost. For others, who need to control their installation remotely, they act as a complement, at negligible cost, as an independent witness. The priority then remains to secure the control system properly.

It is one layer of protection among others: useful for some, not sufficient on its own for others.

In conclusion

This attack cost hundreds of teams dearly, in stock, time and nerves, through no fault of their own. It is a reminder that refrigeration, long seen as a purely technical matter, has become a security issue.

There is no single solution. There are simple things to check right now, old equipment to replace, and good reason not to entrust monitoring solely to the system you are trying to protect.

If you would like to discuss it, we are here to listen.

Sources