The refrigerator attacks in France showed that a cyberattack can stop store operations and food storage without leaking personal information. Between the night of October 11 and the early hours of October 12, 2026, refrigeration and freezer equipment at several French retailers was attacked, leading to food disposal.
The central issue was the remote management device. Attackers targeted the channel used to change temperatures and operating schedules from outside the store.
This article distinguishes confirmed facts from causes still unknown and sets out checks for businesses and individuals in Korea. The information cutoff is October 22, 2026.
What happened in the French refrigerator attacks
Attackers remotely manipulated refrigeration equipment to activate the defrost function, which melts frost. This function is also part of normal operation, but prolonged use can disrupt food storage. Several chains, including Intermarché and Coopérative U, reported damage, and stores had to remove fresh and frozen foods from shelves.
| Category | Confirmed information | Points to bear in mind |
|---|---|---|
| Timing | Refrigeration equipment in France attacked from the night of October 11 to the early hours of October 12 | Remote control and food disposal occurred |
| Impact | Reports of damage at hundreds of stores across several retail chains | Distinguish initial counts from later counts |
| Targets | Danfoss AK-SM and AK-SC, Copeland and Dixell xweb | Product families named in the CERT-FR alert |
| Status | Investigation opened; official response guidance updated on October 16 | Do not assume the incident has ended or recovery is complete |
The reported number of affected stores varies with the reporting date. It is more accurate to describe an incident that spread to hundreds of stores than to establish a final total from early reports alone.
Store counts and counts of internet-exposed devices must also be distinguished. Management interfaces found through searches cannot all be assumed to have been compromised.
Confirmed compromises and suspected causes are different
CERT-FR, under France's national cybersecurity authority, confirmed the compromise of several refrigeration controllers. It did not identify any single vulnerability as the confirmed cause of this attack. Explaining the French refrigerator attacks through one known vulnerability identifier would confuse a confirmed compromise with a possible attack route.
Claroty researchers previously analysed hidden authentication routes that bypass normal login procedures, command execution vulnerabilities, and other issues in the web management functions of the Danfoss AK-SM 800A. The manufacturer responded with new firmware after receiving their report. However, the product studied in that research and the older devices mentioned in this incident must not be treated as the same product.
Current products also need inspection if they use old firmware. Conversely, devices whose support has ended may receive no security updates even if users wait.
Record the exact model, installed version, and support status together, rather than just the model name. This distinction is the starting point for deciding whether to update, restrict access, or replace equipment.
What businesses and individuals in Korea should check now
The French refrigerator attacks do not mean refrigeration equipment in Korea has been compromised. However, businesses using outsourced remote maintenance can ask the same questions.
The following table adapts public response guidance and equipment security analysis into proposed checks for Korea. Carry out actual measures with personnel who understand site safety and maintenance procedures.
| Who | What to check now | Records to check |
|---|---|---|
| Businesses and stores | Remove direct internet exposure of management interfaces; move necessary remote access to protected channels | External access routes and responsible contractors |
| Businesses and equipment staff | Check model, firmware, end-of-support status, and whether default passwords were changed | Device inventory and update history |
| Businesses and maintenance contractors | Check for unauthorized changes to temperature thresholds, defrost schedules, and alarm settings | Normal settings and change records |
| Businesses and operations staff | Check overnight abnormal-temperature alerts, staff contacts, and food relocation procedures | Alert recipients and response sequence |
| Individuals and device administrators | Check whether remote management is needed, along with updates and account settings | Manufacturer support guidance |
| Individuals and consumers | Check official store notices on suspended sales, recalls, and related measures | Notices from stores and relevant authorities |
Disconnecting remote access also requires a sequence of steps. CERT-FR advises checking insurance terms before blocking data sent to maintenance contractors. Stores should first understand how cooling operations and alarm delivery connect, establish a protected access route, and then define a procedure to verify normal settings.
Maintenance contracts should also record who updates equipment and who revokes accounts. Responsibilities can fall through the gaps when the equipment purchaser and the company actually accessing it are different. Check for accounts belonging to former employees or contractors whose contracts have ended, and identify who checks changes made overnight.
Frequently asked questions
Q. Were the French refrigerator attacks ransomware?
Public information alone does not establish that this was a ransomware incident. Manipulation of refrigeration equipment is separate from claims of file encryption or ransom demands. Do not speculate about attackers' identities or motives without investigation findings.
Q. Is changing the password enough?
That alone is insufficient. Accounts need checking, but external exposure of management interfaces and firmware must also be examined.
Hidden authentication routes or software flaws may not be resolved by changing an ordinary password. Consider update availability and access controls together.
Q. Can a reset device be reconnected immediately?
A reset alone does not remove the risk of compromise recurring. CERT-FR warns that exposing unsupported devices without security fixes can lead to another compromise. After recovery, revalidate settings and use a protected remote access route.
The lesson from the French refrigerator attacks is that administrative permissions controlling equipment also need protection. When reviewing customer information and payment systems, review the remote access inventory for refrigeration and air conditioning equipment as well. Check who can change which settings, alongside normal-operation indicators.
Sources
CERT-FR (2026-10-16) https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/ BleepingComputer (2026-10-12) https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/ Nozomi Networks (2026-10-13) https://www.nozominetworks.com/blog/french-supermarket-fridge-cyberattacks-and-the-risks-of-internet-connected-ot Claroty Team82 (2026-08-09) https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
