Supermarket refrigerators remotely manipulated, an electronic voting platform slowed, and personal data stolen: in a few days, several cyberattacks disrupted daily life in France.
The offensive of October 12, 2026 against the refrigeration installations of hundreds of stores illustrates a new risk for consumers: hacking can also damage equipment and lead to material losses.
The Essentials
- October 12: several hundred supermarkets affected by the hacking of cooling systems, with temperatures reaching 50°C in some equipment.
- October 9: the online vote of the left primary disrupted by an influx of automated connections; organizers say ballots were not altered.
- October 10: CNAF reports a data leak concerning its Vacaf holiday aid service.
- October 7: AP-HP confirms the theft of identity data of 1,015 patients via a meal-management software.
- September 29: ANSSI details weaknesses exploited during the summer intrusions into the public finances systems.
Freezers pushed to 50 °C: the cyberattack that destroyed goods
In the night from Sunday 11 October to Monday 12 October, hackers targeted the cold-control systems of several French distribution networks. They allegedly modified the defrosting parameters, making certain equipment function as heat sources for several hours. Result: break in the cold chain, discarded products, disruptions to operations and damage in stores.
According to an initial census published by Le Monde, the chains affected include about 300 Intermarché and Netto stores, around 100 Coopérative U, 80 Carrefour, about 30 Monoprix, as well as several E.Leclerc establishments. These estimates are provisional and do not constitute a consolidated official tally.
In Gradignan, near Bordeaux, the manager of an Intermarché described a temperature rising to 50 °C in a cold room. He mentioned €21,000 worth of goods lost, at purchase price, for his store alone. Elsewhere, fire protection systems were triggered and fire starts were reported. The national damage figure was not yet consolidated as of October 12.
The Paris prosecutor’s office opened an investigation assigned to the Anti-Cybercrime Office to identify victims, link the incidents, and assess consequences.
The weak point: poorly protected connected equipment
The investigations focus on the refrigeration control systems from Danish manufacturer Danfoss. The company indicated that the majority of affected units were old, past their life, and no longer receiving security updates. Alerts about vulnerabilities had already been disseminated.
On October 12, a CERT-FR alert also reported compromises affecting Danfoss AK-SM and AK-SC controllers. Among the initial recommended measures were disconnecting or filtering management interfaces accessible from the Internet, followed by installing patches and securing access.
What changes with this type of attack
The compromised software does not simply store data: it controls physical equipment. Remotely changing the defrosting, the temperature or the alarms can interrupt a service and cause losses of goods, even without theft of banking data.
Electronic voting: the left primary disrupted from its opening
On Friday October 9 at 8 a.m., the e-vote platform used for the social-democratic left primary suffered a massive influx of automated connections. This saturation attack, known as a DDoS, made access to the ballot more difficult for a portion of voters.
More than 140,000 voters were invited to participate in this ballot, according to the information released at its opening. The organizers extended voting until Sunday, October 11 at 6 p.m. They say that the platform was not completely disrupted and that the integrity of the recorded votes was preserved. No public information allows drawing conclusions about ballot falsification.
Families and hospitals: personal data also targeted
On October 10, the Caisse nationale des allocations familiales (CNAF) confirmed an incident concerning Vacaf, its holiday aid service. After reporting a data leak from beneficiaries, access to the vacaf.org platform was suspended as a precaution. CNAF specified that passwords for access to CAF services and banking data were not affected, and that the payment of benefits continued normally. The number of people affected remained to be established.
Three days earlier, on October 7, the Assistance publique–Hôpitaux de Paris (AP-HP) confirmed the theft of identity data of 1,015 patients, from a meal-management module used in 23 hospitals. According to the establishment, the exposed information mainly concerned the patients’ identities and internal references, with no medical or banking data identified in the published materials.
What ANSSI discovered in the tax attacks
The report published on September 29, 2026 by the National Agency for the Security of Information Systems (ANSSI), following intrusions carried out between May and August into the systems of the General Directorate of Public Finances (DGFiP), describes three decisive weaknesses.
- Compromised credentials: legitimate accounts were used after password theft, notably in contexts of personal device use and lack of strong authentication on sensitive portals.
- Networks insufficiently segmented: some applications were overly exposed, allowing progression toward sensitive resources.
- Detection failing: the two waves of data exfiltration were not detected either by the DGFiP’s monitoring or by ANSSI’s.
These conclusions show that poorly protected access, unupdated systems, and insufficient monitoring can have significant effects, even when the attack does not rely on novel techniques. The operating methods, however, differ from one incident to another.
And in Tunisia: what concrete lessons?
The issue also concerns Tunisian companies and institutions, without being able to affirm that local brands use the same vulnerable refrigeration controllers. No verified element also allows signaling a similar attack in Tunisia.
There is, however, a national preventive framework. The National Cybersecurity Agency (ANCS) recommends updating systems, patching vulnerabilities, limiting remote access, and monitoring equipment. In a communication dated September 4, 2026 on Circular No. 5 concerning public platforms, it notably highlights multifactor authentication, audits, protection against DDoS attacks, and continuity plans.
For operators of food distribution, cold-storage warehouses, logistics, or health, the operational questions are simple: which equipment can be managed from the Internet? Who holds the access credentials? Are the firmware updates still maintained? Is there an alarm and a degraded mode in case of compromise?
The French case mainly demonstrates the importance of checking the security of technical service providers and connected equipment, beyond computers and websites alone.
Distinct attacks, a common protection challenge
The hacked refrigerators, the saturation of an electoral platform, the leakage of family data, and the exposure of hospital information involve different scenarios. No public evidence currently allows attributing them to a single group or a state.
Their succession nevertheless reveals a reality: cybersecurity now conditions the continuity of very concrete services, from food supply to administrative procedures, through to the organization of a ballot. The protection of these services depends as much on updating equipment and managing access as on the ability to quickly detect an intrusion.
