The France Freezer Hack: What Happened and How to Secure Your HVAC Controls

EZYAIR letterhead with logo and contact details

When fridges and freezers can be controlled from a phone, they can also be controlled by the wrong people. That is the lesson from the so called France freezer hack, where attackers took over supermarket refrigeration controllers and turned cold aisles into ovens. Here is what happened, in order, and what Melbourne homes and businesses can do to keep their connected heating, cooling and refrigeration secure.

What happened in France (October 2026)

Shortly before midnight on Sunday 11 October 2026, the digital thermostats controlling hundreds of supermarket cold aisles across France began to rise. According to The Guardian, hackers remotely overrode temperature settings on thousands of freezers, fridges and chiller cabinets, pushing them from as low as -27°C to well over 50°C. Over the next four to six hours the food defrosted, then began to cook. One Normandy supermarket reported freezers pushed to 80°C, and staff at an Intermarché in Issy-les-Moulineaux said theirs reached 62°C. In some stores the heat sparked fires that set off sprinklers.

France's Finance Minister told parliament about 700 supermarkets were affected (CNN). Les Mousquetaires, owner of Intermarché, said fridges at about 150 of its stores were heated to 50°C overnight for six hours. Carrefour said 80 stores were hit, Monoprix said 5% of its roughly 490 stores, and Coopérative U said about 80 of its stores (ABC News). E.Leclerc stores were also affected. Intermarché's chief executive said losses could reach tens of millions of euros.

How the attackers got in

Supermarket cold aisles run on control panels that maintenance companies can reach over the internet. France's cyber security agency ANSSI said attackers got into controllers from at least three makers: Danfoss, Copeland and Dixell. Its alert CERTFR-2026-ALE-012 lists Danfoss AK-SM and AK-SC series and Copeland and Dixell xweb controllers.

Danfoss said many affected units no longer received software or security updates or were running outdated firmware (CNN). In August 2026, researchers at Claroty Team82 had published flaws in the Danfoss AK-SM 800A, including a way to bypass normal sign in, and Danfoss released fixed firmware R4.3.1. A researcher told The Guardian many freezers appeared to be running with a default password, and investigators found the attackers disabled alarms or extended defrost cycles so nobody was warned until staff arrived in the morning. No one has claimed responsibility.

The spread across Europe

Within days, a French threat researcher told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected, though without detail (ABC News, CNN).

Then on Monday 2 November 2026, a second wave hit stores across the continent. CNBC, reporting Reuters said fridges and freezers at dozens of stores were affected, including Ahold Delhaize and Colruyt stores in Belgium and Luxembourg, Swedish grocers ICA and Coop, 15 Carrefour stores in Belgium, 13 SuperValu stores in Ireland and at least one IKEA store. A Stockholm ICA store said all its freezers reached 50°C and everything was destroyed. A Belgian butcher estimated he lost about €15,000 worth of meat. Claroty reported the wave also reached Estonia, Finland and the Netherlands, and that a Danfoss spokesperson told Dutch broadcaster NOS the attacked systems were not on secure networks and were protected with a default password. It is not yet known whether the two waves are linked.

Could it happen here?

Experts told the ABC a similar attack could happen in Australia. As University of Queensland's Ryan Ko put it, attackers usually get in through compromised credentials, vulnerable remote access, third party suppliers or poorly secured control platforms, and once inside they can change set points across many sites at once. The same goes for the Wi-Fi air conditioner controllers, building management systems (BMS) and remote monitoring that are now common in Melbourne homes, offices, cafes and cold rooms.

How to secure connected HVAC and refrigeration controls

  • Change every default password. Researchers quoted by The Guardian said many of the French freezers appear to have been running with a default password, and Danfoss told Dutch broadcaster NOS the second wave systems were protected with a default password (reported by Claroty).
  • Keep firmware up to date. Danfoss said the affected units were running outdated firmware and has urged customers to keep supported systems updated.
  • Replace controllers that no longer get updates. Many impacted Danfoss units no longer received software or security updates. If your controller is end of life, plan its replacement.
  • Do not expose controllers directly to the internet. France's CERT-FR says exposing a management interface on the internet goes against good practice and advises removing that exposure.
  • Use a VPN for remote access. CERT-FR advises restoring remote access only through a secure VPN or protected network.
  • Put building controls on a separate network. Keep HVAC, refrigeration and BMS devices on their own network or VLAN, away from guest Wi-Fi and office computers.
  • Turn on multi-factor authentication. Use it on cloud portals and manufacturer apps wherever it is offered.
  • Run independent temperature alarms. In France, investigators found the hackers disabled alarms or stretched defrost cycles so alarms would not trigger. A separate alarm that sends a text to your phone gives you a second line of defence.
  • Check defrost settings. CERT-FR recommends reviewing the full configuration, especially defrost schedules.
  • Ask your installer. Ask who has remote access to your system, how it is secured and when it was last updated.

EZYAIR has installed and serviced heating, cooling and refrigeration across Melbourne since 2007, and we are a VEU accredited provider (A2261). If you are not sure who can reach your air conditioning or refrigeration controls, or whether your controller still gets updates, contact our team and we will help you check it.

Frequently asked questions

What was the France freezer hack?

In October 2026, hackers remotely took over the controllers running fridges and freezers in hundreds of French supermarkets. They pushed temperatures to around 50°C, and in some stores higher, spoiling food and in some cases causing fires.

Which supermarkets were affected?

Reports name Intermarché, Carrefour, Monoprix, Coopérative U and E.Leclerc in France. A second wave on 2 November 2026 hit stores run by Ahold Delhaize, Colruyt, ICA, Coop, Carrefour Belgium, SuperValu in Ireland and at least one IKEA store.

How did the hackers get in?

France's cyber security agency named Danfoss AK-SM and AK-SC controllers, plus Copeland and Dixell xweb controllers. Danfoss said affected units were running outdated firmware, and many no longer received security updates. Experts also pointed to controllers left exposed on the public internet and default passwords.

Could this happen in Australia?

Australian experts quoted by the ABC said similar attacks could happen here, because many cold rooms and display cases are managed through control panels that can be reached over the internet.

Is my home Wi-Fi air conditioner at risk?

Any device you can control over the internet needs basic security. Change default passwords, keep the app and firmware updated, use a strong Wi-Fi password and turn on multi-factor sign-in on the manufacturer's app where offered.

What should a business with refrigeration or a BMS do now?

Find out which controllers can be reached from the internet, take them off public addresses, use a VPN for remote access, update or replace unsupported controllers, change default passwords and set up independent temperature alarms. Ask your refrigeration or HVAC contractor to check it with you.

Sources

Older Post
Compare Selected
Products Name
Price
Color
Size
Availability
Rating
Description
You have successfully subscribed!