In this article
Updated on 4 November 2026. We keep this page up to date from public sources, all of which are cited. An investigation is under way and several points may still change.
The key facts
On 12 October 2026, CERT-FR, the French government's cyber alert centre, reported numerous compromises of remote controllers on refrigeration installations. According to ANSSI, France's national cybersecurity agency, these attacks exploited basic security weaknesses. A second wave hit other European countries in early November. The perpetrator has not been identified.
Timeline
- Night of 11 to 12 October 2026. In France, refrigerated cabinets in supermarkets are switched into defrost and their temperature rises, up to 50 °C according to the head of a retail chain quoted by the French public news service Franceinfo.
- 12 October. CERT-FR publishes its alert, updated on 13 and 16 October.
- 21 October. In a hearing before the French Senate, the director general of ANSSI refers to basic security weaknesses, direct exposure to the internet and weak passwords. He also mentions the healthcare sector, down to pharmacies storing vaccines. Public Sénat, the Senate's news channel, reports more than 700 French supermarkets affected.
- Night of 1 to 2 November. CNBC reports fridges and freezers affected from Sweden to Belgium. In Belgium, the public broadcaster RTBF refers to several dozen shops, with temperatures rising to about 15 degrees.
- 2 November. The Belgian federal prosecutor's office opens an investigation, according to RTBF.
- 3 November. Cybersecurity Dive reviews the European investigations and reports that US military authorities are in contact with the French services about failures on their bases. No link has been established at this stage.
What has not been established
- Who is behind it. To our knowledge, no attribution had been established as of 4 November.
- Whether the two waves are linked. The same mechanism has been mentioned, but there is no public evidence of the same perpetrator.
- The overall toll. Published figures vary with the date and the source. There is no definitive count.
Not one particular brand
CERT-FR cites equipment from several manufacturers, operated at their customers' sites. An exposure or password weakness can also be corrected site by site.
What you can check
- First, check whether your controller is exposed to the internet. We summarise the official recommendations in this article.
- Check the configuration, including the defrost schedules, as CERT-FR asks.
- Ask yourself how you would know, one night, that the temperature is rising if the alarm goes through the affected equipment.
On this last point, a separate second reading gives you another view of the temperature. It does not secure the controller and does not replace these checks. Why independent monitoring.
