Hackers Turn Supermarket Refrigerators Into a Cybersecurity Warning

French Supermarket Fridge Hack Shows the Risks of Connected Devices

A cyberattack targeting refrigeration systems at supermarkets in France has shown that internet-connected devices can create real-world disruption far beyond stolen data.

The attack, reported in October 2026, affected refrigeration equipment used by several supermarket chains, including Intermarché and Netto. According to reports, attackers remotely manipulated refrigeration controls, triggering defrosting functions and pushing temperatures as high as 50°C in some locations. Hundreds of stores reportedly had to discard fresh and frozen food.

The incident highlighted a growing cybersecurity risk: connected devices are increasingly linked to essential physical operations. Refrigerators, heating systems, security cameras, alarms and industrial controllers can now be monitored and managed remotely. If their software, passwords or remote-access systems are compromised, attackers may be able to alter settings, disrupt operations or use the devices as a pathway into wider networks.

In the French incident, the exact attack method and those responsible remained under investigation. However, cybersecurity researchers have previously identified vulnerabilities in commercial refrigeration controllers, including systems used in supermarkets and other food-retail environments.

The risks extend beyond businesses. Internet-connected cameras may expose live video or audio feeds, while smart appliances can reveal information about users, their routines or connected accounts. A compromised device may also be used to attack other systems on the same network.

Security agencies recommend several basic protections. Organisations and households should replace default passwords, enable multifactor authentication where available, install firmware updates and remove devices that no longer receive security support. Unnecessary remote-management features should be disabled, and IoT equipment should be placed on a separate network from computers and sensitive business systems.

For commercial operators, stronger measures are essential. Refrigeration and building-management systems should not be directly exposed to the public internet. Remote access should use secure VPNs, with strict permissions, monitoring and emergency manual controls. Operators should also test whether alarms can detect abnormal temperature changes before products are damaged.

The supermarket attack is a reminder that cybersecurity is no longer confined to computers and websites. A vulnerable connected device can affect food supplies, business continuity, physical safety and public trust.

As more organisations connect everyday equipment to the internet, security must be designed into the entire device lifecycle—from purchase and installation to maintenance, monitoring and eventual replacement.