DEV Community

CD Security Lab
CD Security Lab

Posted on

Hackers Turned Supermarket Fridges Into Ovens: How It Worked and How to Stop It

#security #iot #microsoft #kql

In October 2026, fridges and freezers in hundreds of French supermarkets heated up to 50°C in the middle of the night. The stores were closed, nobody was inside, and the alarms stayed quiet. All the food was thrown away, and some stores reported fires. Three weeks later it happened again, this time in six other European countries.

No ransomware. No virus. The attackers used the normal settings menu of the refrigeration controllers, the same menu the repair technician uses.

This article is the written version of my video. It covers what happened, how the attack worked step by step, what one night cost, seven rules to stop it, and a basic lab with Microsoft Defender, Defender for IoT, Sentinel and Entra. Every query from the video is below.

Video chapters

  • 0:00 Fridges at 50°C in six countries
  • 0:25 Night 1: France
  • 0:52 Night 2: six more countries
  • 1:13 The target: the store's cooling brain
  • 1:49 The attack, step by step
  • 2:22 Three possible doors
  • 2:58 Many stores, settings changed at night
  • 3:23 The silent defrost trick
  • 3:47 What one night cost
  • 4:45 How to stop it: 7 rules
  • 5:48 Quick lab: Defender, Defender for IoT, Sentinel, Entra
  • 6:56 Your checklist

The investigations are still open. I only state what has been reported by named sources, and I say clearly what is not confirmed yet.

1. What happened

Wave 1: France, one night

  • When: the night of Sunday 11 October 2026, into Monday 12 October.
  • What: fridges and freezers were pushed up to about 50°C for around six hours.
  • Who was hit: Les Mousquetaires, the group behind Intermarché, said about 150 stores. Other reports say up to 180. Carrefour reported about 80. Monoprix was hit too.
  • Damage: all affected food was discarded. Fires were reported in some stores, and Paris prosecutors opened a criminal investigation.

Wave 2: six more countries

  • When: the night of 1 to 2 November 2026. In Belgium the attack started around midnight. An ICA store in Stockholm says its attack happened at 2 a.m. and staff noticed at 5:30 a.m.
  • Where: Belgium, Luxembourg, Sweden, Estonia, the Netherlands and Ireland. More than 115 stores.
  • How: the company that runs Delhaize's cooling systems said the evaporators were switched to defrost mode.
  • Who did it: nobody has claimed it.

The EU agriculture commissioner called it a deliberate attempt to disrupt Europe's food supply chain.

2. First, how supermarket cooling works

The brain of the cold: one controller, many fridges

A big supermarket has dozens of fridges and freezers. They are all connected to one central refrigeration controller. Think of it as the brain of the cold. It does three jobs:

  1. Keeps the temperature at the setpoint (for example −18°C for frozen food).
  2. Defrosts: a few times a day it warms the coils for a short time to melt the ice.
  3. Raises an alarm when a temperature is wrong.

The controller also has a web page, so the refrigeration service company can log in from far away and fix problems without driving to the store. Very useful. And dangerous, if a hacker can reach that page too.

3. How the attack worked, step by step

Three possible doors

This is the conceptual path, based on what researchers, vendors and the French cyber agency have said so far. The exact entry point is still under investigation.

Step 1: Find the targets

Attackers don't guess, they search. Public internet scanners list every device that answers on the internet. Researchers counted 2,528 web pages of this controller family open to the internet in 73 countries, 1,331 of them in France. In other words, a ready-made target list existed before the attack.

Step 2: Get in (three possible doors)

Door What is known Status
Old devices The manufacturer said most affected controllers were old models with no more security updates. Reported by the vendor
A known bug In 2025, researchers disclosed a way to skip the login on some of these controllers. Newer models got a fix in August 2025. Old models did not. Public research
Weak passwords Some news reports mention simple default passwords. Not confirmed. France's CERT still told owners to change every default password.

CERT-FR also widened its warning to other vendors' web consoles for refrigeration. This is a class problem, not one vendor.

Step 3: Many stores at once

In France, one refrigeration service company managed many stores. One way in can open many doors. This is the same supply-chain shape we see in IT: compromise the provider, reach all of its customers.

Step 4: Change the settings at night

No malware was needed. The attackers used the normal menu: they raised the temperature setpoint, or switched the fridges to defrost. They did it around 2 a.m., when nobody was in the store.

Step 5: Stay quiet

This is the clever part. During defrost, a warm fridge is normal, so the controller holds back its temperature alarm. Defrost usually lasts minutes. The attackers stretched it from one hour up to eight hours. The fridges got hot and the alarm said nothing. In Sweden, staff only found out hours later.

Defrost stretched to 8 hours, alarm muted

No virus. No ransom. Just normal settings, used against them.

4. What one night cost

Six kinds of damage from one night

  1. Food. Meat, fish, milk and frozen food, all thrown away.
  2. Safety. Warm food can make people sick, so nothing could be sold.
  3. Money. The Intermarché group expects losses of several million euros. Its CEO said it could reach tens of millions of euros nationwide in a single day.
  4. Fire. Some stores reported real fire damage.
  5. Customers. Empty fridges and closed aisles send shoppers to another store. Empty fridges also look like a food shortage, even when there isn't one.
  6. Blame. The retailer, the manufacturer, the service company: everyone asks whose job this was.

And it happened again three weeks later. When an attack works, others copy it.

5. How to stop it: seven rules

Seven rules

  1. Know what you have. List every connected device: fridges, cameras, lights, doors. If it's on the network, it's on the list.
  2. Keep it off the internet. No controller web page open to the world. Never.
  3. Old device? Replace it, or hide it. If it gets no updates, put it on its own network segment behind a firewall.
  4. Update and lock it. Install the latest firmware. Change every default password on day one.
  5. Control the service company. Give them one safe way in, with MFA, and only to the devices they maintain.
  6. Watch it. Send the logs to your security team. Alert when the internet talks to your controllers. Alert when settings change at night.
  7. Have a backup alarm. A simple, independent thermometer that calls someone, even if the controller is hacked.

6. Quick lab: the basics with Microsoft tools

Lab: contoso store, one fridge controller behind a firewall

My lab is a fake store on contoso.com with one controller, CTRL-STORE01, on the subnet 10.20.30.0/24 behind a firewall. All names and numbers are invented.

Check 1: Microsoft Defender finds the devices

Defender for Endpoint device discovery can find unmanaged devices on your network, including IoT devices. Query 1 lists IoT devices that face the internet. If this list is not empty, fix that first.

// 1. Defender XDR advanced hunting: IoT devices that face the Internet
DeviceInfo
| where DeviceCategory == "IoT"
| where IsInternetFacing == true
| summarize arg_max(Timestamp, *) by DeviceId
| project Timestamp, DeviceName, Vendor, Model, PublicIP
Enter fullscreen mode Exit fullscreen mode

Check 2: Microsoft Defender for IoT watches the cooling network

Defender for IoT is built for operational technology like refrigeration controllers. You put a network sensor on the fridge network (a mirror or SPAN port). It only listens and never touches the devices. First it learns what normal looks like, then it alerts on anything new: a new connection from the internet, or someone changing a setting.

One planning note: Microsoft has announced that the OT security part of Defender for IoT retires in October 2029 (Message Center MC1526670). If you start now, plan for that.

Check 3: Microsoft Sentinel brings the alerts together

Query 2 reads the firewall logs and looks for internet traffic that reached the cooling subnet. In a well-built network it should return nothing. One result is an incident.

// 2. Sentinel: Internet traffic reaching the cooling controller subnet (lab subnet)
let CoolingSubnet = "10.20.30.0/24";
CommonSecurityLog
| where TimeGenerated between (ago(1d) .. now())
| where ipv4_is_in_range(DestinationIP, CoolingSubnet)
| where not(ipv4_is_private(SourceIP))
| where DeviceAction !in~ ("deny", "drop", "block")
| summarize Sessions = count(), FirstSeen = min(TimeGenerated) by SourceIP, DestinationIP, DestinationPort
Enter fullscreen mode Exit fullscreen mode

Query 3 shows the Defender for IoT alerts in Sentinel, such as unauthorized internet access or configuration changes.

// 3. Sentinel: Defender for IoT alerts (new internet access, setting changes)
SecurityAlert
| where ProductName has "IoT"
| where AlertName has_any ("Internet", "Unauthorized", "Programming", "Configuration")
| project TimeGenerated, AlertName, AlertSeverity, CompromisedEntity
Enter fullscreen mode Exit fullscreen mode

Check 4: is the controller's web page reachable from outside?

Run this from a machine outside your network. In the lab the expected answer is that the connection fails.

# 4. PowerShell: is the lab controller's web page reachable from outside?
Test-NetConnection -ComputerName ctrl-store01.contoso.com -Port 443
Enter fullscreen mode Exit fullscreen mode

The service company: Microsoft Entra with MFA

Instead of an open web page, the service company signs in through Microsoft Entra with MFA and reaches only the controllers it maintains, for example with Microsoft Entra Private Access.

7. Your checklist for this week

  • [ ] List every device that faces the internet.
  • [ ] Replace or isolate old devices.
  • [ ] Service company access only with MFA.
  • [ ] Alert on setting changes at night.
  • [ ] Add an independent backup temperature alarm.

Your fridge is a computer now. Treat it like one.

What's the oldest device on your network? Tell me in the comments.

Sources

News:

Official Microsoft sources:

All lab names, IP ranges and devices are invented (contoso.com).

Thanks for reading! I'm Cuong, and on CD Security Lab I rebuild real Microsoft security cases in a safe lab and explain them simply. Follow along:

Got a question about your own tenant? Drop it in the comments.

Top comments (0)