A cyberattack that hit refrigeration systems at hundreds of French supermarkets overnight on October 11-12, 2026, has turned into a case study in industrial control system exposure. More than 400 stores across three retail banners reported temperature failures after attackers gained remote access to refrigeration controllers made by Danfoss, Copeland, and Dixell. France’s national cybersecurity agency, CERT-FR, confirmed the compromises, and the Paris prosecutor’s office opened a criminal investigation on the Monday following the attack. No group has claimed responsibility.
What makes this incident worth a second look, beyond the spoiled food and the viral images of fridges reading 50°C (122°F), is what it reveals about the state of operational technology (OT) security in retail. The equipment at the center of the attack was not exotic. It was standard refrigeration monitoring hardware, some of it directly reachable from the public internet, some of it running firmware that has not received a security patch in years. That combination, old hardware plus open network paths, is a pattern security researchers have flagged in industrial systems for over a decade. This time it played out across supermarket chains that millions of French shoppers rely on every day.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened on October 11-12
According to reporting from the Associated Press, the intrusion unfolded overnight, with attackers remotely manipulating refrigeration-management systems at stores across France. More than 400 supermarkets were reported affected in total. The breakdown by chain: roughly 300 Intermarché and Netto locations (both operated under the Les Mousquetaires group), about 80 Coopérative U stores, and around 30 Monoprix outlets.
The practical effect was straightforward and damaging. Refrigeration units that are supposed to hold steady at near-freezing temperatures instead climbed, with some reportedly reaching 50°C. At that temperature, chilled and frozen inventory, meat, dairy, prepared foods, becomes unsafe within hours. Store staff had to pull and discard products across affected locations rather than risk selling spoiled stock. OCCRP’s coverage of the incident described the scale as unusual for a retail-sector cyberattack, both in the number of physical locations hit simultaneously and in the direct, visible consequence for consumers walking into a store the next morning.
CERT-FR, the French government’s computer emergency response team, confirmed that the compromised equipment included Danfoss AK-SM and AK-SC refrigeration controllers alongside Copeland XWEB and Dixell XWEB monitoring systems. All four are established names in commercial refrigeration, used not just in France but across European and North American retail chains to monitor and remotely adjust cooling equipment in supermarkets, convenience stores, and cold-storage warehouses.
The Access Problem: Controllers Facing the Open Internet
The detail that has drawn the most attention from security professionals is not the attack itself but the access path. Some of the refrigeration controllers involved were directly reachable from the public internet, without the kind of network segmentation or VPN gating that OT security guidance has recommended for years. That is a configuration choice, usually made for convenience, so technicians or vendors can check on equipment remotely without routing through a corporate VPN, rather than a sophisticated exploit.
It is a familiar failure mode. Industrial and building-management systems were largely designed around the assumption of a closed network, not an internet-connected one. As remote monitoring became a selling point, vendors and integrators exposed management interfaces to make that monitoring convenient, often without matching that convenience with equivalent access controls. CBC News framed the French incident as a wake-up call for exactly this reason: the hardware doing the exposing is rarely the flashy, headline-grabbing kind of technology. It is the boring infrastructure that keeps food cold, buildings heated, and water treated, and it has quietly become some of the most exposed technology on the internet.
This incident sits in the same broader category as other recent remote-access security failures covered on this site, including the three-flaw zero-day chain in Ivanti Connect Secure and Citrix NetScaler that granted attackers root access, and the PAN-OS flaw hitting CVSS 8.6 disclosed earlier this year. In each case, the common thread is a remote-access or remote-management layer that was reachable from outside the intended trust boundary.
Danfoss Responds: “Obsolete Products” at End of Life
Danfoss issued a statement addressing the affected equipment directly. The company said: “Most of the affected units are obsolete products (…) that have reached end of life and no longer receive software or security updates.” That single sentence does a lot of work in explaining why this attack was possible in the first place. Hardware that has aged out of a vendor’s support lifecycle does not stop running. Refrigeration controllers, unlike consumer electronics, often stay in service for ten or fifteen years because replacing a supermarket’s entire cooling monitoring stack is expensive and disruptive.
The result is a long tail of equipment running outdated firmware, sometimes with known weaknesses that will never be patched because the vendor has moved on to newer product lines. That dynamic is not unique to Danfoss, Copeland, or Dixell. It describes a huge share of operational technology across manufacturing, logistics, healthcare facilities, and retail. The difference with this incident is that it became visible to the public almost immediately, because the consequence was food spoiling in stores rather than a quiet data exfiltration that might go unnoticed for months.
According to CERT-FR’s reported guidance following the incident, affected operators were advised to disconnect any refrigeration systems exposed through public IP addresses and restore connectivity only through protected networks or a secure VPN. Recommended defensive steps included changing default passwords, applying whatever firmware updates remain available, reviewing configurations, and enabling the strictest security settings the hardware supports, even on older units that no longer receive full vendor support.
Store Counts by Retailer
The table below summarizes the reported scope of the incident by retail banner, based on figures confirmed in press reporting as of October 17, 2026.
| Retail Banner | Parent Group | Reported Stores Affected | Primary Impact |
|---|---|---|---|
| Intermarché | Les Mousquetaires | ~300 (combined with Netto) | Refrigeration temperature failure |
| Netto | Les Mousquetaires | ~300 (combined with Intermarché) | Refrigeration temperature failure |
| Coopérative U | Système U | ~80 | Refrigeration temperature failure |
| Monoprix | Groupe Casino | ~30 | Refrigeration temperature failure |
| Total reported | Multiple groups | 400+ | Food discarded, store-level disruption |
Those figures are the ones CERT-FR and the retailers themselves have confirmed publicly. The exact financial cost, in spoiled inventory and lost sales, has not been disclosed by any of the affected groups, and no outlet has published a verified total. Any number circulating beyond what the companies and CERT-FR have stated should be treated as unconfirmed.
The Vulnerable Stack: What Danfoss, Copeland, and Dixell Actually Do
For readers outside the refrigeration industry, it helps to understand what these systems are built to do. Danfoss AK-SM and AK-SC units are rack-mounted controllers that sit in a supermarket’s back room and manage the compressors and evaporators that keep display cases and walk-in freezers at set temperatures. Copeland XWEB and Dixell XWEB are monitoring and alarm platforms that sit alongside those controllers, logging temperature data and sending alerts when something drifts out of range. Together, they form the nervous system of a store’s cold chain.
These systems are typically networked so a facilities team, or in many cases a third-party service contractor, can check in remotely rather than drive to every store location. That is a legitimate and widely used operational model. The security failure is not the existence of remote access itself, but the absence of the access controls that should gate it: network segmentation separating refrigeration systems from the open internet, VPN-only remote connections, and credential hygiene that avoids default or reused passwords on internet-facing management interfaces.
Affected Systems and Vendor Response
| System | Vendor | Role | CERT-FR Status |
|---|---|---|---|
| AK-SM | Danfoss | Refrigeration controller | Confirmed compromised |
| AK-SC | Danfoss | Refrigeration controller | Confirmed compromised |
| XWEB | Copeland | Monitoring and alarm platform | Listed as potentially affected |
| XWEB | Dixell | Monitoring and alarm platform | Listed as potentially affected |
Danfoss has publicly acknowledged that the bulk of the affected units are end-of-life products no longer receiving security updates. Copeland and Dixell have been named by CERT-FR as vendors whose monitoring platforms were implicated, though as of October 17, neither company has issued the kind of detailed public statement that Danfoss has. That gap in vendor communication is itself notable: when critical infrastructure vendors stay quiet during an active investigation, it leaves operators guessing about whether their specific hardware model and firmware version is actually at risk.
CERT-FR and the Paris Prosecutor’s Investigation
CERT-FR’s role in this incident has been twofold: confirming the technical details of which systems were compromised, and issuing remediation guidance to operators, not just the retailers directly hit, but any business in France or elsewhere running the same Danfoss, Copeland, or Dixell equipment. That guidance, disconnect public-facing refrigeration systems, use a secure VPN for remote access, change default credentials, apply available patches, is unglamorous but represents the baseline that OT security practitioners have been pushing for years without universal adoption.
Separately, the Paris prosecutor’s office opened a criminal investigation on the Monday following the attack. As of this writing, prosecutors have not identified the individuals or group behind the intrusion, and no one has claimed responsibility. Time’s coverage of the investigation noted that the lack of a claim is itself unusual for an attack with this much public visibility; many ransomware and hacktivist operations use media attention as leverage, and the silence here has left investigators working from technical forensics alone.
Why This Reads Differently From a Typical Data Breach
Most cybersecurity stories involve stolen data: customer records, payment card numbers, intellectual property. This one involves a physical consequence with no data theft angle reported so far. That distinction matters for how the incident should be understood. OT attacks that manipulate physical processes, rather than exfiltrate information, sit in a different risk category because the damage is immediate, visible, and in this case tied directly to public health and food safety rather than privacy.
It also changes the incentive structure for attackers. A data breach can be monetized quietly through resale on criminal forums. Flipping refrigeration units to 50°C produces no obvious financial payoff unless it is extortion, sabotage, or a demonstration of capability. Since no ransom demand or claim of responsibility has surfaced, investigators are left considering a wider range of motives, including the possibility that this was a proof-of-concept attack by an actor testing how far a single intrusion into exposed OT hardware could reach across a retail chain’s footprint.
Market Impact: Retail, Insurance, and the Cost of Legacy OT
For the retailers involved, the immediate cost is inventory loss. Discarding chilled and frozen stock across hundreds of locations is expensive even before accounting for lost sales during the disruption window. None of the affected groups, Les Mousquetaires, Système U, or Groupe Casino, has published a verified total loss figure, and any number beyond that should be treated as speculative until the companies or CERT-FR confirm one.
The longer-term cost is likely to land on capital budgets. Supermarket chains that have been deferring refrigeration controller replacement, treating “it still works” as sufficient justification to keep end-of-life hardware in service, now have a public, well-documented incident to point to when justifying the spend internally. That mirrors a pattern seen across other sectors after high-profile OT incidents: budget approval for infrastructure modernization tends to follow a visible failure rather than precede it.
Insurers covering retail and food-safety liability are also likely to take notice. Cyber insurance underwriting has increasingly asked policyholders about OT exposure and remote-access hygiene, not just IT-side endpoint protection. An incident with this much public documentation gives underwriters a concrete reference point for pricing refrigeration and cold-chain risk going forward, in France and in other markets with similar equipment deployed.
How This Compares to Other Remote-Access Failures
This is not the first time 2026 has produced a headline about internet-exposed infrastructure with inadequate access controls. Earlier this year, the FortiMail zero-day that hit CVSS 9.8 landed on CISA’s Known Exploited Vulnerabilities list after attackers used it against internet-facing mail gateways. The pattern across these incidents, mail gateways, VPN appliances, and now refrigeration controllers, is consistent: a device sits at the edge of a network, exposed for legitimate operational reasons, and becomes the entry point once a flaw or misconfiguration is found.
What separates the French supermarket incident from those IT-focused cases is the physical consequence. A compromised mail gateway or VPN appliance typically leads to data access or lateral movement inside a network. A compromised refrigeration controller leads directly to spoiled food within hours, with no intermediate step and no need for the attacker to pivot further into the network to cause damage. That makes OT exposure a different kind of risk calculation: the blast radius is smaller in scope but faster and more visible in effect.
It also echoes concerns raised in other 2026 cybersecurity coverage about legacy systems holding sensitive operational data well past their intended service life, as seen in the ongoing scope expansion of the UK Legal Aid Agency breach, where files going back to before 2007 turned out to still be sitting in exposed systems years after anyone expected them to matter.
The Industrial Security Gap Nobody Budgets For
Security teams at large retailers tend to be organized around point-of-sale systems, e-commerce platforms, and customer data, the parts of the business with obvious regulatory exposure under data protection law. Refrigeration, HVAC, and building-management systems typically fall under facilities management rather than IT security, which means they are evaluated on uptime and maintenance cost rather than attack surface. That organizational split is a big part of why OT devices end up internet-facing in the first place: the team managing them is not the team thinking about network segmentation.
Closing that gap requires either merging OT oversight into the security organization or, more realistically for most retailers, building a formal handoff process where facilities teams consult security before any new remote-access configuration goes live. CERT-FR’s post-incident guidance, disconnect exposed systems, use VPN-gated access, rotate credentials, points at the same conclusion from a different angle: these are basic IT security practices that were never consistently applied to OT hardware because nobody owned that responsibility clearly.
What Happens Next: Five Predictions
Based on how similar OT security incidents have played out in other sectors, a few outcomes look likely over the coming months.
- Expect other European retailers running Danfoss, Copeland, or Dixell equipment to audit their own remote-access configurations in the coming weeks, prompted directly by CERT-FR’s advisory rather than waiting for a regulatory mandate.
- Expect at least one of the three vendors named in the incident to publish a more detailed security advisory or patch notice beyond Danfoss’s initial statement, as pressure from CERT-FR and affected customers builds.
- Expect the Paris investigation to take months rather than weeks to identify a suspect, if one is ever identified publicly, given that CERT-FR and prosecutors have not yet established the initial access method.
- Expect French and EU regulators to reference this incident in future discussions of critical infrastructure and supply-chain cybersecurity rules, given the direct link to food safety and public health.
- Expect insurance underwriters covering retail and cold-chain logistics to begin asking more specific questions about refrigeration and building-management system exposure during policy renewals.
Lessons for Other Industries Running Legacy OT
Retail is far from the only sector running refrigeration, HVAC, or process-control hardware that has aged past its vendor support window. Hospitals, cold-storage warehouses, pharmaceutical distributors, and food manufacturers all depend on similar monitoring and control equipment, often from the same handful of vendors. Any organization in those categories has reason to check, this week rather than next quarter, whether its own controllers are reachable from the public internet and whether default credentials are still in place.
The practical checklist is not complicated, even if executing it across hundreds of store locations is. Inventory every internet-connected OT device. Confirm whether it needs to be internet-facing at all. Where remote access is genuinely required, route it through a VPN rather than a direct public IP. Change default passwords, even on equipment nobody expects to be targeted. And where a vendor has confirmed a device is end-of-life with no further security updates coming, treat replacement as a security budget line item rather than a facilities maintenance decision that can wait.
The Broader Signal for Retail Cybersecurity
Retail cybersecurity conversations have spent the better part of a decade centered on point-of-sale malware and customer data breaches, the kind of incidents that produce lawsuits and regulatory fines tied to privacy law. This incident does not fit that mold, and that is precisely why it is drawing attention from security researchers who have been warning for years that OT exposure in retail was underestimated relative to IT exposure. A supermarket chain can have excellent point-of-sale security and still lose hundreds of thousands of euros in spoiled inventory because a refrigeration controller from 2012 was sitting on the open internet with a default password.
The BBC’s reporting on the incident captured the public-facing side of that disconnect well: shoppers walking into stores the next day, encountering empty shelves where chilled goods used to be, with little visibility into the fact that the cause was a remote intrusion into back-office refrigeration hardware rather than a supply chain shortage or a labor dispute. That gap between what consumers see and what actually happened is part of why OT security incidents tend to get less sustained public attention than data breaches, even when the operational disruption is larger.
Frequently Asked Questions
What caused the French supermarket refrigeration cyberattack?
Attackers gained remote access to refrigeration controllers made by Danfoss, Copeland, and Dixell, some of which were directly reachable from the public internet. CERT-FR confirmed the compromises; the exact intrusion method has not been publicly disclosed.
How many stores were affected?
More than 400 supermarkets were reported affected, including roughly 300 Intermarché and Netto locations, about 80 Coopérative U stores, and around 30 Monoprix outlets.
Did temperatures really reach 50°C?
Reports indicate some affected refrigeration units reached approximately 50°C (122°F), forcing stores to discard chilled and frozen inventory that could no longer be considered safe to sell.
Has anyone claimed responsibility for the attack?
No. As of October 17, 2026, no group or individual has claimed responsibility, and the Paris prosecutor’s office has not publicly identified any suspects.
What did Danfoss say about the vulnerable equipment?
Danfoss stated that most of the affected units are obsolete products that have reached end of life and no longer receive software or security updates.
What is CERT-FR recommending to operators?
CERT-FR has advised disconnecting refrigeration systems exposed through public IP addresses, restoring connectivity only through protected networks or a secure VPN, changing default passwords, applying available firmware updates, and using the strictest available security settings.
Is this connected to other recent zero-day or remote-access incidents?
It is not confirmed to be technically linked to other 2026 incidents, but it follows a broader pattern seen in cases like the Ivanti Connect Secure zero-day chain and the FortiMail CVSS 9.8 flaw: internet-facing systems exposed without sufficient access controls.
Could this happen to supermarkets outside France?
Danfoss, Copeland, and Dixell refrigeration systems are used in retail chains across Europe and North America, so any operator running similarly configured, internet-exposed equipment faces a comparable risk until access controls are tightened.
