France’s Supermarket Hack Started With a Shockingly Simple Password, Spoiling Millions of Euros of Food

Hackers allegedly exploited weaknesses in supermarket refrigeration systems to make fridges and freezers heat up across hundreds of French stores, spoiling fresh and frozen food potentially worth millions of euros.

The most alarming detail is a reported password linked to the current date, raising questions about how easily internet-connected equipment designed to keep food safe could be compromised.

Major retailers including Carrefour, Intermarché, Netto, Monoprix and Coopérative U were affected. Some refrigeration units reportedly reached 50 degrees Celsius (122 F), while fires were reported at certain locations.

Rather than stealing customer information or shutting down supermarket tills, the attackers allegedly turned essential cooling equipment against the businesses operating it, leaving staff to deal with spoiled stock and disrupted operations.

The Password That Could Bring Down a Supermarket

The most striking claim concerns refrigeration controllers reportedly using the username 'admin' alongside a password that changes daily to match the current date.

If confirmed as part of the attack, this would raise serious questions about whether such a predictable password offers meaningful protection against someone attempting to access a system remotely.

However, there is a related security flaw that researchers have independently documented. In an investigation published in August 2026, cybersecurity firm Claroty's Team82 found that certain Danfoss refrigeration controllers had a hidden login method that could allow someone to bypass the normal password check using a special code generated from the current date.

In simple terms, it is like discovering a back door into a supermarket that opens without a key, even though the front entrance is locked. Someone who knows how that back door works could potentially get inside without knowing the usual password.

Researchers also identified other weaknesses that could allow deeper access to the equipment. Danfoss addressed the reported vulnerabilities through software updates.

However, investigators have yet to confirm whether hackers used this particular weakness, the reported date-based password, or another method to break into the French supermarkets' refrigeration systems.

How Hackers Turned Fridges Into Heaters

Modern supermarket refrigeration systems use electronic controllers to manage temperatures, defrost cycles, alarms and other functions across multiple units.

Danish engineering company Danfoss supplies software that allows retailers to monitor and manage refrigeration equipment remotely. This makes it easier to control an entire store's cooling systems without checking every individual freezer.

Under normal conditions, freezers periodically defrost, allowing ice to melt before the equipment returns to its usual cooling cycle.

In this incident, Intermarché reportedly said its refrigeration units heated to 50 degrees Celsius for six hours overnight. Rather than gamble with customers' health, the retailer threw the food out, according to Reuters.

Additional claims suggest attackers disabled alarms and forced extended defrost cycles, preventing staff from receiving warnings before temperatures rose. Those details have not been independently confirmed as the method used in the attack.

The damage went further than a technical fault. Staff arriving at the affected supermarkets said hot air was blowing out of the refrigeration units, while small fires were reported at some locations.

Two supermarkets in France's Alsace region reported combined losses of €270,000 (£228,000), according to the original report. The nationwide financial impact could reach millions of euros.

Hundreds of Stores Affected as Retailers Scramble To Recover

The scale of the disruption has become clearer as supermarket groups disclosed the damage.

Carrefour reported that 80 of its approximately 6,000 stores were affected. Earlier figures identified more than 100 Coopérative U supermarkets and 180 Intermarché and Netto stores as targets, with a further 100 shops disconnected from the internet as a precaution.

Later updates put the number of affected Intermarché and Netto locations at more than 300, although the full national total remains unclear.

Monoprix also reported affected stores and said products were removed from sale whenever their condition could not be guaranteed. Retailers worked to restore equipment and replenish shelves.

French prosecutors opened a cybercrime investigation into what the Paris prosecutor's office described as a 'large-scale cyber-attack affecting the refrigerators of several major food retail chains across France'.

Why Outdated Refrigeration Systems Pose a Wider Risk

Danfoss said the affected refrigeration units were older models running outdated software. The company has repeatedly warned businesses to keep systems updated and replace outdated equipment.

Updating industrial equipment is not always as straightforward as installing an app update. Businesses may need specialist support, on-site work and scheduled downtime, making large-scale upgrades difficult to coordinate.

Claroty's research illustrates the risks. Its investigation found that thousands of refrigeration management interfaces were publicly accessible online, potentially allowing attackers to reach vulnerable equipment without first breaking into a company's internal network.

The implications extend beyond spoiled food. If attackers can manipulate equipment businesses depend on every day, the consequences can include financial losses, disrupted services and potential safety risks.

European Food Commissioner Christophe Hansen condemned the incident, writing on X: 'Food security requires more attention at all levels. Because the weaponisation of food has become a reality.'

For France's supermarket chains, the immediate challenge is restoring refrigeration and replacing discarded stock. The bigger question is whether businesses have secured the connected systems that quietly keep food safe, before the next vulnerable controller is targeted.