EDITION OF OCTOBER 15, 2026
Refrigeration systems hacked in France: remote access security under scrutiny
Ars Technica reports a hack affecting around 700 supermarkets in France, with food destroyed and, sometimes, fires. Its article describes vulnerable connected controllers and probably insufficient network protections. The financial toll and precise technical responsibilities remain to be established.
Legal disclosure: this content was produced by an artificial intelligence system. Editorial transparency
The hacking of refrigeration systems in French supermarkets highlights the physical consequences of poorly protected connected equipment. According to Ars Technica, remotely accessible controllers allowed the installations to be tampered with. The reported information points to known vulnerabilities and inadequately controlled network exposure.
A hack of refrigeration systems reportedly affected around 700 supermarkets in France early this week, according to Ars Technica. The outlet reports food losses and, in some cases, fires. According to the French authorities cited, the attackers compromised the connected controllers that allow technicians to manage stores’ installations remotely. They then activated defrosting devices long enough to raise temperatures to as high as 50 °C.
The article links this attack to critical vulnerabilities documented in the controllers concerned, marketed by Danfoss, Dixell and its parent company Copeland. These flaws allow remote access with administrator privileges. At Danfoss, some equipment used a daily password calculated from the date by publicly accessible firmware. Someone analyzing that code could therefore reproduce the calculation on devices without a recent update. Under these conditions, changing the password daily did not provide sufficient protection.
Ars Technica also considers it likely that the affected stores had neither placed this equipment behind a VPN nor restricted the IP addresses allowed to connect. This assessment by the outlet must be distinguished from the information attributed to the authorities: the article does not establish the details of each retailer’s configurations. The Pen Test Partners researchers cited recommend removing the controllers from the public Internet, controlling service providers’ connections, replacing known credentials and applying patches.
Copeland acknowledges a vulnerability in a discontinued generation of controllers that has reached end of life, and says it is working with its customers to prevent further incidents. Danfoss had not responded to Ars Technica’s questions at the time of its article. The outlet also notes that Claroty and the US agency CISA had already warned about these risks.
The issue therefore extends beyond the availability of a patch. This attack illustrates how maintenance access can become a means of controlling equipment with immediate physical effects. The analysis calls for examining network exposure, service provider management and keeping equipment up to date together. It does not, however, identify the perpetrators or precisely quantify the damage: the financial estimates put forward remain uncertain.