Hundreds of French supermarkets, including major chains like Intermarché and E.Leclerc, had their networks breached overnight on October 11, 2026, by unidentified hackers who targeted the buildings’ Operational Technology (OT) systems, exploiting legacy refrigeration controllers connected to the internet for remote management.
The cybercriminals likely exploited known vulnerabilities, overrode defaults, and forced a nonstop defrost cycle, raising fridge and freezer temperatures to 50°C over about six hours. This destroyed large quantities of perishable food and, in some cases, caused electrical fires from overheated cooling equipment.
“The same risk applies to the modern connected home,” warns Miguel Fornés, cybersecurity expert and Information Security Manager at data privacy service Incogni. “When we buy cheap, white-labeled IoT devices with poor support, no firmware updates, and hardcoded passwords, we expose these vulnerable devices to the public internet by connecting them to Wi-Fi without changing default settings. Once these EOL or unpatched household devices are compromised, they not only expose our sensitive data but also give threat actors a physical foothold in our homes, allowing them to unlock doors, manipulate heating systems, or co-opt the devices into massive botnets.”
Fornés observes this incident mirrors a similar attack in August 2026, when U.S. military commissaries across several states experienced simultaneous freezer failures: “In both cases, the core vulnerability was the same: obsolete, End-of-Life (EOL) hardware exposed on the open internet. The targeted Danfoss models had not received automatic security updates for years, being left defenseless against basic exploits like authentication bypasses and command injection.”
Below are five suggestions from Incogni cybersecurity expert Miguel Fornés to help consumers secure their household IoT from cyber-physical threats:
- Isolate IoT Devices on a guest network: Never allow smart home gadgets (cameras, thermostats, smart plugs) to operate on the same Wi-Fi network as your personal laptops and smartphones.
- Change default credentials immediately: Many IoT breaches start with the factory-default admin passwords (like “admin/admin”) left unchanged. As soon as you unbox an IoT device, the first thing you should do is access its interface and change the password.
- Disable Universal Plug and Play (UPnP): UPnP allows devices to automatically open ports on your router to the public internet, a similar flaw that exposed the French supermarkets. Disable UPnP in your home router’s settings to prevent smart devices from bypassing your firewall.
- Audit and update firmware: Treat smart devices like software. Regularly check the manufacturer’s app or website for firmware updates. If a device has reached “End-of-Life” (EOL) and the manufacturer no longer provides security patches, immediately disconnect it from the internet and replace it.
- Disable remote access features: Unless you absolutely need to adjust your thermostat or view a camera while away from home, disable the device’s remote cloud access features. If remote management is required, never expose the device directly; use a secure, encrypted home VPN tunnel instead.
