A cyberattack has disrupted refrigeration systems at more than 400 supermarkets across France, forcing chains including Intermarché, Netto, Coopérative U and Monoprix to scramble as fridges and freezers lost remote control overnight, according to multiple outlets including the Associated Press. At one affected chain, refrigeration units reportedly heated to 50°C (120°F) overnight, spoiling fresh, frozen and meat products worth what retailers describe only as “millions of euros.” No group has claimed responsibility, and French prosecutors have not named a suspect.
What makes this incident different from a typical retail breach is the target: not point-of-sale systems or customer databases, but the industrial controllers that keep food cold. France’s cybersecurity agency has confirmed the affected equipment runs on platforms built by three named vendors, Danfoss, Copeland and Dixell, and at least two of those platforms were publicly flagged as vulnerable by security researchers at Claroty back in August, roughly two months before the attack hit. That gap between warning and exploitation is the story the rest of the French food retail sector, and every other operator running legacy industrial control systems (ICS), now has to reckon with.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened Across French Supermarkets
The attack hit refrigeration infrastructure at supermarkets operated by several of France’s largest grocery groups. Intermarché and Netto reported around 300 affected shops between them. Coopérative U reported 80 affected stores, and Monoprix reported 30. Carrefour, E.Leclerc and Les Mousquetaires were also named among the retailers hit, though those chains have not disclosed exact store counts. Reports on the total scale of the incident vary, with figures ranging from at least 350 stores to more than 500, and no single confirmed number has been agreed across outlets.
The systems involved are remote refrigeration-management platforms, the kind that let a chain monitor and adjust every fridge and freezer in a store, or across hundreds of stores, from a central dashboard. When those platforms were compromised, the attackers (or the fault condition they triggered) pushed refrigeration units at one chain to heat up to 50°C overnight instead of holding their normal cold-storage range. Staff arriving the next morning found spoiled meat, dairy, and frozen goods that had to be discarded across the chain’s network.
| Retail Group | Reported Stores Affected | Status |
|---|---|---|
| Intermarché & Netto | ~300 shops | Confirmed affected |
| Coopérative U | 80 shops | Confirmed affected |
| Monoprix | 30 shops | Confirmed affected |
| Carrefour | Not disclosed | Named as affected |
| E.Leclerc | Not disclosed | Named as affected |
| Les Mousquetaires | Not disclosed | Named as affected |
The financial hit is still unquantified. Retailers have described losses in the “millions of euros” range without giving a precise figure, and no outlet has published an audited total. That ambiguity itself is notable for an incident this size: a chain that loses a chilled supply chain overnight does not just lose inventory, it loses the ability to sell fresh categories at all until systems are restored and stock is replenished, which compounds the direct loss with lost sales days.
The Vendors Named: Danfoss, Copeland and Dixell
France’s cybersecurity agency identified the compromised infrastructure as running on equipment from three vendors: Danfoss, Copeland and Dixell. Specific Danfoss products named in the reporting include the AK-SM800, the AK-SC355 and the AK-SM 800A, all refrigeration-management controllers used to centrally run supermarket cooling systems. Copeland’s XWeb Pro platform, which performs a similar remote-monitoring role, was also named.
These are not consumer gadgets. They are industrial controllers meant to sit on a store’s internal network and talk to a vendor’s cloud or a retailer’s central operations center, adjusting temperature setpoints, flagging compressor faults, and logging performance across hundreds of locations at once. That function, letting one dashboard reach every fridge in a chain, is exactly what makes the category attractive to attackers and exactly what magnified the blast radius once something went wrong, a point explored in a related breakdown of the ICS security gaps exposed across the 400-plus affected stores.
| Vendor | Product Named | Flagged Issue |
|---|---|---|
| Danfoss | AK-SM800 | Legacy product, no longer receiving software/security updates |
| Danfoss | AK-SC355 | Legacy product, no longer receiving software/security updates |
| Danfoss | AK-SM 800A | Vulnerability disclosed by Claroty in August |
| Copeland | XWeb Pro | Vulnerability disclosed by Claroty in August |
| Dixell | Refrigeration controllers (unspecified models) | Named by French cybersecurity agency as implicated |
The August Warning Nobody Acted On in Time
The detail that turns this from a single bad night into an industry warning is timing. Cybersecurity research firm Claroty published findings in August describing vulnerabilities in the Danfoss AK-SM 800A and Copeland XWeb Pro platforms, the same product lines later confirmed as compromised in the October attack. Claroty’s report described “numerous controllers” that were directly reachable from the open internet, a configuration that should not exist on equipment controlling physical infrastructure, according to the Associated Press.
Two months is not a long runway for a retailer running hundreds of legacy installations to patch, re-segment networks, and verify every site, but it is also not nothing. The gap between disclosure and exploitation is the part of this story that security teams outside the grocery sector should sit with: a known, public vulnerability in named industrial hardware sat unaddressed at enough locations that a single campaign could hit 400-plus stores in one event.
Danfoss has said that most of the affected equipment consisted of legacy products that no longer receive software or security updates, and that some systems in the field were running outdated firmware. The company said it had previously told customers to update supported systems and migrate legacy hardware to current-generation platforms. In a statement reported by PBS NewsHour, Danfoss said it has long advised customers to keep supported systems updated with the latest firmware and to operate behind a firewall, guidance that, in this case, was evidently not followed everywhere it needed to be.
How the Attack Unfolded Inside the Stores
The exact method used to breach the refrigeration controllers has not been confirmed in public reporting. What is established is the function that was compromised: remote control over the units that keep perishable inventory within safe temperature bands. In at least one affected chain, that remote function was used, or failed in a way, that pushed units to 50°C overnight rather than holding their normal cold range, a 120°F swing far outside any food-safety threshold.
Staff discovered the damage the next morning. Spoiled meat, dairy, frozen goods and other fresh categories had to be pulled from shelves and discarded across every affected location simultaneously, a logistics problem on top of a financial one, since replacement stock cannot simply be air-dropped into hundreds of stores overnight. The scale of simultaneous spoilage, rather than the breach itself, is what pushed this story past a routine IT incident and into national food-security coverage.
Attribution: Still Zero Named Suspects
No individual or group had claimed responsibility for the attack as of this reporting, and French prosecutors had not identified the attackers. That leaves the incident in an unusual spot: the retailers, the regulator, and the vendors have all spoken publicly about what was hit and how to fix it, but nobody has said who did it or why. The exact intrusion method, whether through the internet-exposed controllers Claroty flagged in August, stolen credentials, or another vector, also remains unconfirmed.
That gap matters for how the industry should read this event. Without attribution, it is not possible to say whether this was financially motivated, an opportunistic exploit of known-vulnerable gear, or something more targeted at the French food supply chain specifically. A separate look at the ongoing French investigation found zero suspects identified even as the probe widens. One French supermarket executive, Schelcher, described the incident bluntly: targeting equipment essential to the preservation of fresh products amounts to an attack on the French food supply chain, and called it unprecedented, extremely serious and unacceptable, according to Al Jazeera‘s coverage of the incident.
Vendor Response: What Danfoss and Copeland Are Saying
Copeland issued a statement saying it is currently working with impacted customers to mitigate the risk, a signal that the company is actively engaged in incident response rather than treating the disclosure as closed business. Dixell, for its part, posted a statement framing the incident as a sector-wide problem rather than a company-specific failure, saying cybersecurity is everyone’s business, all the time, and that while competitors were targeted this time, any vendor in the category could be next.
Danfoss’s position is the most detailed of the three. The company has acknowledged that much of the compromised equipment was running outdated firmware on legacy platforms it no longer actively updates, and it has pointed to prior customer guidance recommending firmware updates and firewall-protected deployment. That combination, a vendor that stopped patching old hardware and a customer base that kept running it anyway, is the structural weakness this whole incident exposes, and it is not unique to refrigeration.
France’s Official Guidance to Stores
France’s cybersecurity authority has told affected stores to reconnect their refrigeration systems only through a secure VPN or a protected network, to install available firmware updates, and to change passwords across the controllers. None of that guidance is novel; it is the standard baseline for operational technology (OT) security that has existed for years. The fact that it had to be issued as emergency advice after a 400-plus-store incident says more about adoption gaps than it does about the advice itself.
The agency’s three-part fix, VPN-only access, current firmware, and rotated credentials, maps directly onto what Claroty’s August research had already flagged: controllers reachable from the open internet, running old firmware, on networks without adequate segmentation. Closing that gap at scale across hundreds of independently operated franchise stores is a harder operational problem than writing the advisory, which is part of why the industry is treating this as a wake-up call rather than a one-off.
Why Supermarket Refrigeration Became a Target
Retail refrigeration sits at an odd intersection: it is industrial control equipment, the kind usually associated with power plants and factories, but it is managed with the patch cadence and budget priorities of a retail IT department. Chains operate thousands of stores, each running fridge controllers that were installed years ago and are rarely top of mind for security spend, since a cold case that keeps food cold “looks” like it is working right up until it is not.
That combination, high consequence if it fails, low attention until it does, is precisely the profile security researchers have warned about across other OT sectors for years. Al Jazeera’s reporting on the incident framed supermarkets as having become a target less because grocery chains are uniquely insecure and more because the equipment they rely on was built for an era before internet-connected industrial gear was assumed to be a target at all. Retrofitting security onto infrastructure that predates that assumption is expensive, slow, and easy to defer, until it fails publicly.
Historical Context: A Pattern of Legacy-System Breaches in 2026
This incident does not stand alone in 2026’s cybersecurity calendar. A 53% year-over-year surge in ransomware attacks has already pushed critical-infrastructure operators toward faster patch cycles this year, while the ConnectWise cloud backup breach showed how a single compromised vendor platform can freeze operations across 173 downstream customers at once, the same one-to-many exposure pattern now visible in the fridge attack. Earlier in the year, a BeyondTrust remote-support zero-day rated CVSS 9.3 demonstrated how a single flaw in widely deployed remote-access software can cascade across an entire customer base before patches land everywhere.
The common thread across all three incidents, and now this one, is the lag between a known vulnerability and full remediation across a large, distributed install base. A Palo Alto PAN-OS zero-day disclosed earlier this year followed the same arc: public disclosure, a scramble to patch, and a window during which exposed systems remained reachable. Refrigeration controllers are a new category for that pattern, but the mechanics are identical to breaches already logged elsewhere in 2026.
Market and Industry Impact
For French grocery chains, the immediate cost is inventory loss and operational disruption, but the longer tail is likely to be insurance and compliance. Business-interruption and cyber-insurance policies written for retailers rarely anticipated OT-specific claims at this scale, and insurers covering food retailers are expected to revisit how refrigeration and cold-chain infrastructure is underwritten going forward, since a single campaign hitting 400-plus locations at once is a very different risk profile than a single-store break-in.
For Danfoss, Copeland and Dixell, the commercial pressure points toward faster end-of-life migration programs. Equipment vendors that sell long-lived industrial hardware have historically been slow to force customers off unsupported platforms, since replacement cycles are expensive and customers resist forced upgrades. An incident at this scale, covered by outlets from the New York Times to the BBC, gives those vendors a stronger case internally and with customers for accelerating migration away from legacy controllers, even if that means absorbing short-term support costs.
Competitive Comparison: How Other Critical Infrastructure Sectors Handle This Risk
Energy and water utilities have spent the better part of a decade building out network segmentation standards specifically because their control systems face the same internet-exposure risk now visible in retail refrigeration. Those sectors generally operate under binding regulatory frameworks that mandate patch timelines and network isolation for OT equipment. Retail refrigeration has no equivalent binding standard; the guidance France’s cybersecurity agency issued after this attack, VPN access, firmware updates, password rotation, is advisory, not mandatory, which is a meaningful gap compared with how power-grid operators are required to manage similar equipment.
Healthcare facilities offer a closer parallel: hospitals also run large fleets of legacy, internet-connected equipment (infusion pumps, imaging systems) that vendors eventually stop patching, and the sector has struggled with the same tension between operational continuity and forced hardware replacement. The fridge attack suggests retail cold-chain infrastructure now belongs in that same conversation about how to govern aging, internet-facing OT equipment across an entire industry rather than store by store.
Predictions: Where This Story Goes From Here
- Expect French and EU regulators to open a formal review of OT security requirements for food retail and cold-chain infrastructure within the coming months, following the same path energy-sector rules took after earlier grid-focused incidents.
- Danfoss, Copeland and Dixell are likely to announce accelerated end-of-life timelines for the legacy controllers named in this incident, pushing customers toward current-generation platforms faster than originally planned.
- Insurers covering large grocery chains will likely revise cyber and business-interruption policy language to explicitly address OT and refrigeration-specific claims, given the scale of simultaneous loss across hundreds of locations.
- Other national retail associations outside France are likely to run internal audits of their own refrigeration vendor fleets once the specific product names involved circulate more widely in industry security bulletins.
- Attribution may remain unresolved for an extended period; incidents hitting distributed OT equipment with no ransom note or public claim have historically taken months, if ever, to be definitively attributed.
What Supermarkets and Vendors Should Do Now
The near-term fix is the one France’s cybersecurity agency already published: get refrigeration controllers off the open internet, require VPN or equivalent protected access, apply every available firmware update, and rotate every default or long-unchanged password on the affected platforms. The harder, slower fix is replacing hardware that vendors have stopped supporting entirely, since a firewall and a new password cannot patch a vulnerability the manufacturer no longer issues fixes for.
For chains outside France running the same named Danfoss, Copeland or Dixell product lines, the practical step is an inventory audit: knowing exactly which controllers are deployed, which firmware version they run, and whether any are still reachable without a VPN. Claroty’s August research already did the hard part of identifying which platforms are exposed; the remaining work is confirming whether a given store’s equipment matches that list and closing the gap before, not after, it becomes a headline.
Frequently Asked Questions
How many French supermarkets were affected by the cyberattack?
Reports vary, with figures ranging from at least 350 stores to more than 500. Several major chains, including Intermarché and Netto (about 300 shops combined), Coopérative U (80 shops) and Monoprix (30 shops), confirmed being affected, while Carrefour, E.Leclerc and Les Mousquetaires were also named without disclosed store counts.
Which companies make the affected refrigeration systems?
France’s cybersecurity agency named Danfoss, Copeland and Dixell as the vendors behind the compromised equipment. Specific products named include the Danfoss AK-SM800, AK-SC355 and AK-SM 800A controllers, and Copeland’s XWeb Pro platform.
Was this attack predicted or warned about in advance?
Cybersecurity research firm Claroty published findings in August describing vulnerabilities in the Danfoss AK-SM 800A and Copeland XWeb Pro platforms, roughly two months before the October attack exploited systems running on the same product lines.
Who was responsible for the attack?
No individual or group had claimed responsibility, and French prosecutors had not identified the attackers as of this reporting. The exact method used to access the refrigeration controllers has also not been confirmed publicly.
How much food and money was lost?
Retailers described losses in the “millions of euros” range without providing an audited total. Spoiled fresh, frozen and meat products were discarded at affected stores after refrigeration units reportedly heated to 50°C (120°F) overnight at one chain.
What should stores running the same equipment do now?
France’s cybersecurity agency advised reconnecting refrigeration systems only through a secure VPN or protected network, installing all available firmware updates, and changing passwords across affected controllers. Danfoss has separately urged customers to migrate legacy, unsupported systems to current-generation platforms.
Is this incident connected to other 2026 cybersecurity breaches?
Not directly, but it follows the same pattern seen in other 2026 incidents such as the ConnectWise cloud backup breach and the BeyondTrust remote-support zero-day: a known or disclosed vulnerability in widely deployed vendor software or hardware remaining unpatched across a large customer base until it is exploited at scale.
Could this happen to supermarkets outside France?
Yes, in principle. The named Danfoss, Copeland and Dixell product lines are used by refrigeration operators beyond France, and the underlying weakness, internet-exposed legacy controllers running outdated firmware, is not specific to any one country’s retail sector.
