PDN
Match being pirated right now?Client portalFree scan

Fridges hacked to 50 °C: what the attack on French supermarkets says about connected devices

6 min read

Illustration for the article: Fridges hacked to 50 °C: what the attack on French supermarkets says about connected devices

A refrigerator is hardly an obvious target for a hacker. Yet on the night of October 11 to 12, 2026, hundreds of French supermarkets woke up to refrigerated displays turned into ovens and entire stocks fit only for the bin.

The attack is still under investigation, but it illustrates a risk specialists have been repeating for ten years: every device connected to the internet is a computer, and it must be protected as one.

What happened

The attackers took control of the refrigeration management systems of several hundred stores, including Intermarché, Système U, Carrefour and some Leclerc stores. Figures vary by chain and by media outlet, but they run into the hundreds of stores.

Their method was simple: the defrost function, which normally runs about two hours a day, was turned into a forced, continuous defrost set to 50 °C. In stores hit early in the night, all fresh and frozen products were lost. A single Leclerc store estimates its loss at €220,000. The Paris prosecutor’s office has even mentioned fires breaking out, and the investigation has been assigned to France’s anti-cybercrime office.

No claim of responsibility or ransom demand had been made public at the time of writing.

The targeted devices are Danfoss refrigeration controllers, widely used in food retail. According to the manufacturer, some were models no longer on the market, and others had not received the latest updates.

What they had in common: an administration interface reachable from the internet. In August 2025, the security firm Claroty had already counted more than 2,700 of them exposed online for just one of these models, and reported vulnerabilities that have since been fixed.

CERT-FR, the French government’s incident response team, issued an alert on October 12. It is blunt: exposing a management interface on the internet goes against good practice. Its first recommendation is to disconnect or filter access to the affected controllers.

It is not yet known whether the attackers exploited a vulnerability or simply used valid credentials. The head of ANSSI, the French cybersecurity agency, acknowledged that nothing was really established yet about how the attack was carried out. Either way, the lesson is the same: a device that does not need to be reachable from the internet should not be.

And at home?

Households are not immune. Cameras, TVs, thermostats, appliances, routers: every connected device is a potential way in.

The best-known example remains Mirai, in 2016. This network of infected devices, mostly cameras and video recorders, simply tried a short list of 62 default passwords. That was enough to launch attacks that knocked major websites offline. Ten years later, the principle has not changed: in December 2025, Cloudflare blocked a record 31.4 terabit-per-second attack launched by the Aisuru network from infected Android TVs.

The rules are slowly tightening:

  • in the United Kingdom, since April 2024, identical default passwords are banned on connected devices sold to consumers, and manufacturers must state how long they will provide updates;
  • in the European Union, the Cyber Resilience Act has required the reporting of actively exploited vulnerabilities since September 2026, and its main security obligations will apply in December 2027;
  • in Canada, there is no law specific to connected devices, but the Canadian Centre for Cyber Security publishes clear recommendations.

Good habits

The authorities’ advice is similar from one country to the next:

  • change the default password of every device as soon as it is installed, and turn on two-factor authentication where available;
  • install updates as soon as they are released, and replace devices that no longer receive them;
  • do not expose administration interfaces on the internet; in a business, limit remote access to trusted addresses or go through a VPN;
  • isolate connected devices on a separate network, for example the guest Wi-Fi, away from computers and sensitive data;
  • turn off UPnP on the router, which opens access without your knowledge.

The pirate box, a connected device like any other

There is one device people talk about less, and that our agency knows well: the pirate IPTV box. These small Android boxes, sold to watch thousands of channels at a low price, are also among the most dangerous connected devices.

In June 2025, the FBI warned about BADBOX 2.0, a network of millions of infected devices, mostly cheap streaming boxes. Some are infected before they are even bought; others become infected when apps from unofficial stores are installed. The FBI advises avoiding these stores, especially those offering free streaming content. In early 2026, journalist Brian Krebs described another network, Kimwolf, with nearly two million devices, largely Android TV boxes made and marketed for video piracy.

In other words, a subscriber who plugs a pirate box into their living room is not just getting around copyright: they are often installing on their own network a device that no longer really belongs to them.

The takeaway

The attack on French supermarkets probably required no technical feat. It took advantage of forgotten devices, connected to the internet and never updated. It is the most common scenario, in business as at home.

Our job is to find and remove pirated content, and we see every day how illegal IPTV services and their boxes circulate. If you want to know where your content is being distributed without authorization, start with our free analysis.

Sources

On the same topic

Is your content pirated? We can get it removed.

Talk to an expert1 833 967-1334