Five days after hackers forced hundreds of French supermarket refrigerators into runaway defrost cycles, the story has moved from the walk-in cooler to the courtroom. The Paris prosecutor’s office confirmed it opened a cybercrime investigation into the incident, and French authorities have assigned the case to a specialized unit while the hardware vendors at the center of the breach, Danfoss, Copeland, and Dixell, face pointed questions about why thousands of internet-reachable, end-of-life controllers were still running food supply chains in 2026.What Happened to France’s Supermarket FridgesStore Counts and Systems AffectedParis Prosecutors Open a National Cybercrime CaseCERT-FR’s Response and the Widening AlertDanfoss, Copeland, and Dixell: Three Very Different ResponsesVendor Response ComparisonWhy Legacy Refrigeration Controllers Became the Weak LinkHistorical Context: OT Attacks on Retail and Critical InfrastructureMarket Impact: Retailers, Insurers, and ICS VendorsThe NIS2 Angle: What EU Regulation Means HereWhat Security Experts and Officials Are SayingCompetitive Landscape: How OT Incident Response ComparesPredictions: Where This Investigation Goes NextWhat Retail IT and Facilities Teams Should Do NowFrequently Asked QuestionsRelated Coverage
The attack itself, which struck overnight on October 11 to October 12, 2026, is well documented at this point: refrigeration controllers across more than 400 stores were remotely manipulated, some reportedly reaching 50°C (122°F), spoiling food and reportedly sparking fires in a handful of locations. What’s less settled is who did it, how they got in, and what the investigation now underway in Paris is likely to turn up. That’s the part of the story that matters most for anyone running operational technology (OT) connected to the public internet, whether it’s a supermarket chain, a hospital, or a factory floor.
Industry insights, the latest tech news, and special interviews, all in the Tech Insider Newsletter.
One email a week. No spam, unsubscribe anytime.
Google · Preferred Sources
Don’t miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened to France’s Supermarket Fridges
According to reporting reviewed by AP News, attackers gained remote access to refrigeration management systems built by Danfoss, with France’s national cybersecurity agency later confirming that Copeland and Dixell monitoring platforms were also compromised. The French national Computer Emergency Response Team, CERT-FR, issued an initial alert on October 12 naming Danfoss AK-SM and AK-SC controllers, then widened that alert within a day to include Copeland XWEB and Dixell XWEB systems once investigators realized the intrusion wasn’t confined to a single vendor’s hardware.
More than 400 supermarkets were reported affected in total, spread across three retail groups: roughly 300 Intermarché and Netto locations, 80 Coopérative U stores, and 30 Monoprix outlets. In each case, the common thread wasn’t the retailer’s own IT network, it was refrigeration controllers that were directly reachable from the public internet, a configuration that security researchers have warned about for years but that remains common in industrial and commercial refrigeration deployments because remote monitoring is exactly what these systems were designed to offer technicians and maintenance contractors.
Store Counts and Systems Affected
Retail GroupReported Stores AffectedController/System InvolvedSource
Intermarché & Netto~300 storesDanfoss AK-SM / AK-SCCERT-FR, industry reporting
Coopérative U~80 storesDanfoss AK-SM / AK-SCCERT-FR, industry reporting
Monoprix~30 storesCopeland XWEB / Dixell XWEBCERT-FR, industry reporting
Total reported400+ storesMulti-vendor refrigeration controllersIndustry Cyber, Business Standard
Reports vary slightly on the precise scope, and that variance is itself part of the story. Nobody, including the companies whose equipment was targeted, has produced a definitive, store-by-store accounting of the damage. That ambiguity is exactly what the Paris investigation is now trying to resolve.
Paris Prosecutors Open a National Cybercrime Case
The Paris prosecutor’s office opened its investigation under national jurisdiction rather than leaving the matter to individual retailers or local police, a procedural choice that signals how seriously French authorities are treating an attack that touched food safety, business continuity, and critical supply infrastructure in a single stroke. According to OCCRP, the case has been assigned to France’s specialized cybercrime unit, often referred to by the acronym OFAC in French policing circles (not to be confused with the U.S. Treasury’s Office of Foreign Assets Control of the same initials), which handles large-scale digital intrusion cases that cross retailer and regional lines.
As of this week, prosecutors say they have not identified the individuals or group behind the intrusion, and no ransomware gang or hacktivist collective has publicly claimed responsibility. That silence is notable. Most high-profile OT attacks in the past three years, from pipeline ransomware to manufacturing shutdowns, have come with some kind of public claim, extortion note, or dark-web leak page within days. The absence of one here has left investigators working from forensic artifacts on the compromised controllers themselves rather than from a public boast, a slower and more methodical process that typically takes weeks rather than days to produce attribution with any confidence.
CERT-FR’s Response and the Widening Alert
CERT-FR, operating under France’s broader cybersecurity agency, confirmed compromises involving the Danfoss, Copeland, and Dixell systems named above. Its alert evolved in real time as the scope of the breach became clearer: the first bulletin on October 12 focused on Danfoss controllers, and the updated version issued the following day added Copeland XWEB and Dixell XWEB monitoring platforms once it became apparent the attackers weren’t limited to a single manufacturer’s ecosystem.
That multi-vendor spread is arguably the most alarming technical detail to emerge from the incident so far. A single-vendor vulnerability is a bad day for one company’s customers. A compromise that touches three separate refrigeration-control vendors in the same window points either to a shared underlying weakness, such as a common remote-access gateway or monitoring protocol used across brands, or to attackers who methodically worked through every internet-exposed refrigeration system they could find regardless of manufacturer. CERT-FR’s own advisory guidance leaned toward the latter interpretation, urging operators to pull affected controllers off direct internet exposure and route any remote access through a secured VPN instead.
Danfoss, Copeland, and Dixell: Three Very Different Responses
Of the three vendors named, Danfoss has been the most forthcoming publicly. The company said most of the affected units are obsolete products that have reached end of life and no longer receive software or security updates, and it acknowledged that other compromised systems were running outdated firmware that customers had simply never updated. That statement does double duty: it explains the technical pathway for the breach while also drawing a line between Danfoss’s current product security posture and the risk inherent in equipment some customers have kept running for a decade or more past its intended support window.
Copeland and Dixell, by contrast, have not issued the same kind of detailed public accounting. Neither company has published a breakdown of which specific models were compromised, what firmware versions were affected, or when a fix might ship, even though CERT-FR’s updated alert named both companies’ XWEB platforms directly. That silence doesn’t necessarily mean either company is doing nothing behind the scenes, but it does leave retail IT and facilities teams running Copeland or Dixell hardware with less actionable guidance than Danfoss customers currently have.
Vendor Response Comparison
VendorSystems Named by CERT-FRPublic Statement IssuedRoot Cause Acknowledged
DanfossAK-SM, AK-SC controllersYes, cited end-of-life and outdated firmwareYes, EOL devices and unpatched firmware
CopelandXWEB monitoring platformNo detailed public statement foundNot confirmed publicly
DixellXWEB monitoring platformNo detailed public statement foundNot confirmed publicly
The asymmetry matters for anyone evaluating vendor risk in industrial refrigeration. A company that names its exposure, even when the news is unflattering, gives downstream customers something to act on. A vendor that stays quiet forces its customers to make security decisions blind, which in a food-safety context is a meaningfully worse position to be in than it would be for, say, a consumer app vendor.
Why Legacy Refrigeration Controllers Became the Weak Link
Refrigeration controllers in large retail chains are rarely swapped out on the same cycle as point-of-sale terminals or back-office servers. They’re bolted into walk-in coolers and rooftop condensing units, wired into building management systems, and often left running for ten or fifteen years because replacing them means a service disruption and a capital expense that’s easy to defer when the hardware is, on the surface, still working fine. That economics problem, not a single software bug, is the real root cause CERT-FR’s advisory and Danfoss’s own statement both point toward.
The remote-access feature that made these controllers vulnerable is also the feature that makes them useful. Refrigeration technicians need to check setpoints, review alarm histories, and adjust defrost schedules without physically visiting every store in a 300-location chain, so vendors built in exactly the kind of internet-facing remote management that attackers exploited. The security failure wasn’t that remote access existed; it was that it existed without the network segmentation, VPN gating, or credential hygiene that would normally keep an industrial control interface off the open internet. That’s a pattern that shows up again and again in OT security incidents, from water treatment plants to manufacturing lines, and France’s supermarket fridges are now the most visible recent example of it.
Historical Context: OT Attacks on Retail and Critical Infrastructure
The French refrigeration incident fits a broader pattern that cybersecurity researchers have been warning about for several years: operational technology that was never designed with internet exposure in mind is increasingly being connected to the internet anyway, for cost and convenience reasons, and then left there without the monitoring that IT networks take for granted. Retail refrigeration is a particularly stark example because the consequences are immediate and physical. Unlike a data breach, where the damage is often invisible for months, a manipulated refrigeration setpoint produces spoiled food, lost revenue, and potential fire risk within hours.
What distinguishes this incident from a typical ransomware case is the absence of an extortion demand. Most OT-adjacent attacks against retail or industrial targets over the past several years have come with a ransom note, a leak-site listing, or a public claim designed to pressure the victim into paying. The silence following the French attack suggests either a different motive, such as research, disruption for its own sake, or a geopolitical signal, or simply an attacker group that hasn’t yet decided how, or whether, to monetize what it accomplished. Investigators in Paris are reportedly treating both possibilities as live lines of inquiry.
Market Impact: Retailers, Insurers, and ICS Vendors
The immediate financial impact falls on the retailers themselves, through spoiled inventory, emergency maintenance call-outs, and the labor cost of manually checking and resetting controllers across hundreds of locations overnight. None of the retail groups involved, Intermarché, Netto, Coopérative U, or Monoprix, has published a specific damage estimate, and any total food-loss figure currently circulating should be treated as unconfirmed until the companies or investigators release one.
The more durable impact may land on the refrigeration-controls vendors and, by extension, on the broader market for industrial and building-management hardware. Danfoss, Copeland, and Dixell all sell into commercial refrigeration well beyond France’s borders, and retail chains elsewhere in Europe and North America running the same AK-SM, AK-SC, or XWEB product lines now have a concrete reason to audit their own exposure rather than waiting for a similar incident at home. Cyber insurers that underwrite retail and food-distribution risk are also likely to start asking pointed questions in renewal cycles about whether refrigeration and building-management systems sit on segmented networks, a line item that has historically gotten far less underwriting scrutiny than point-of-sale or customer-data systems.
The NIS2 Angle: What EU Regulation Means Here
France’s supermarket chains fall within the scope of entities the EU’s NIS2 directive treats as important or critical depending on size and sector, and food distribution is explicitly among the sectors the directive was written to cover. NIS2 raises the bar on cybersecurity risk management, incident reporting timelines, supply-chain due diligence, and access control for in-scope companies, and it does so in a way that’s meant to pull operational technology into the same governance umbrella as traditional IT rather than treating OT as a separate, lower-priority category.
The practical question this incident raises for regulators and compliance teams alike is whether a refrigeration controller counts as the kind of asset NIS2’s risk-management obligations are supposed to reach, and if so, whether retailers have actually inventoried those devices the way they’ve inventoried servers and laptops. Early indications from the CERT-FR advisory, asset inventory, network segmentation, controlled remote access, and firmware currency, read like a checklist that maps directly onto NIS2’s risk-management language. Expect this incident to show up as a reference case in future NIS2 enforcement guidance and in vendor risk-assessment questionnaires across the EU retail sector.
What Security Experts and Officials Are Saying
France’s cybersecurity agency described the scope of what it found in stark terms, saying it became “aware of numerous compromises” once it began examining the Danfoss and Copeland remote-control refrigeration modules involved in the attack, according to AP News. The agency also framed its response as operating on two tracks at once, saying it was working “both at the national level, to accompany potential victims, and at the European level to coordinate with its counterparts,” a comment reported by Time that underscores how quickly a retail refrigeration incident escalated into a cross-border coordination exercise.
Prosecutors have been measured in their public statements so far. The Paris prosecutor’s office described the case as a “large-scale cyberattack affecting the refrigerators of several major food retail chains across France,” and added that “an investigation will be necessary to shed full light on this attack,” both lines reported by AFP. Danfoss, for its part, has stuck to a narrower technical explanation, telling reporters that many of the affected units simply “no longer receive software or security updates,” a statement reported by CNN that places at least part of the blame on aging hardware rather than a novel exploit.
Competitive Landscape: How OT Incident Response Compares
France’s response, led by CERT-FR with a parallel criminal investigation out of Paris, broadly mirrors how the United States handles comparable OT incidents, where CISA issues technical advisories while the FBI or Secret Service pursues attribution separately. The split-track model has become close to a global standard: a technical agency focuses on helping victims and other potential targets patch and harden, while a law-enforcement body focuses on identifying and eventually prosecuting whoever is responsible, and the two workstreams share information without one blocking the other.
Where this incident stands out is the multi-vendor scope. Most comparable OT advisories name a single product line from a single manufacturer. CERT-FR naming three separate vendors, Danfoss, Copeland, and Dixell, within a 48-hour window is unusual, and it’s pushing the agency’s advisory closer to a sector-wide warning about commercial refrigeration as a category rather than a single-product security bulletin. That distinction matters for any retailer running refrigeration hardware from a fourth vendor not yet named in the advisory: the underlying lesson, internet-exposed building-control systems are a liability regardless of brand, applies whether or not their specific vendor shows up in a CERT-FR bulletin.
Predictions: Where This Investigation Goes Next
Attribution will likely take weeks, not days. With no public claim of responsibility and no ransom note, investigators are working from forensic evidence on the controllers themselves, a slower process than cases where attackers identify themselves.
Expect retailers outside France running Danfoss, Copeland, or Dixell refrigeration hardware to quietly audit their own internet-facing exposure in the coming weeks, even absent a public mandate to do so.
Copeland and Dixell will likely be pressed, by customers if not by regulators, to match Danfoss’s level of public disclosure about which specific models and firmware versions were affected.
This incident is likely to become a reference case cited in NIS2 enforcement discussions and vendor risk questionnaires across the EU food and retail sector through 2027.
Cyber insurers covering retail and food-distribution risk are likely to add refrigeration and building-management systems as a specific underwriting question in upcoming policy renewals.
What Retail IT and Facilities Teams Should Do Now
The practical guidance coming out of CERT-FR’s advisory is not complicated, which is part of why the incident is so uncomfortable for the industry: remove refrigeration controllers from direct internet exposure, route any remote access through a secured VPN rather than an open port, inventory every connected building-management device the same way IT inventories servers and endpoints, and replace or isolate hardware that has reached end of life and no longer receives security updates. None of that is novel security advice. What’s novel is how directly the consequences of ignoring it showed up this time, in spoiled food and, in some reported cases, fires, rather than in a quietly exfiltrated database that nobody notices for months.
For teams outside the retail sector, the transferable lesson is about asset inventory discipline. Building-management systems, refrigeration controls, HVAC gateways, and similar operational technology tend to fall outside the scope of standard IT asset-management tools, which means they’re also the pieces of infrastructure most likely to be running years-old firmware with a public IP address nobody remembers assigning. The French incident is a concrete, well-documented argument for treating OT asset inventory as a security requirement rather than a facilities-department afterthought.
Frequently Asked Questions
What caused the French supermarket refrigeration cyberattack?Attackers gained remote access to refrigeration controllers made by Danfoss, Copeland, and Dixell that were reachable from the public internet. Danfoss has said many of the affected units were end-of-life hardware or were running outdated firmware, though the precise intrusion method has not been publicly confirmed.
Who is investigating the attack?The Paris prosecutor’s office opened a cybercrime investigation under national jurisdiction. France’s cybersecurity agency, operating through CERT-FR, is handling the technical response and advisory side in parallel.
Has anyone claimed responsibility for the attack?No. As of this reporting, no individual, group, ransomware gang, or hacktivist collective has publicly claimed responsibility, and prosecutors say they have not identified the culprits.
Which stores and retailers were affected?Reports cite more than 400 stores in total, including roughly 300 Intermarché and Netto locations, 80 Coopérative U stores, and 30 Monoprix outlets.
What have Danfoss, Copeland, and Dixell said publicly?Danfoss has acknowledged that many affected units were obsolete and no longer received software or security updates, and that others were running outdated firmware. Copeland and Dixell had not issued a comparably detailed public statement as of this reporting, despite both being named in CERT-FR’s updated advisory.
How high did refrigeration temperatures reportedly reach?Some units reportedly reached around 50°C (122°F), according to reporting on the incident, though totals and exact figures across all affected stores have not been independently confirmed.
Does the EU’s NIS2 directive apply to this kind of incident?Food distribution is among the sectors NIS2 covers, and the directive’s risk-management, access-control, and incident-reporting requirements are designed to apply to operational technology as well as traditional IT. This incident is likely to be referenced in future NIS2 compliance and enforcement discussions for the retail and food sector.
What should other retailers running similar refrigeration systems do?CERT-FR’s guidance, removing controllers from direct internet exposure, routing remote access through a VPN, inventorying connected devices, and replacing or isolating end-of-life equipment, applies to any retailer running comparable hardware, regardless of vendor.
Related Coverage
Sofia LindströmEditor-in-ChiefSofia Lindström is the Editor-in-Chief at Tech Insider, where she leads editorial strategy and oversees coverage across AI, cybersecurity, and enterprise technology. With over a decade in Swedish tech journalism, she previously served as technology editor at Dagens Industri and covered the Nordic startup ecosystem for Breakit. Sofia holds an MSc in Media Technology from KTH Royal Institute of Technology and is a frequent speaker at Web Summit and Slush. She is passionate about making complex technology accessible to business leaders.View all articles
The Tech Insider Newsletter
Industry insights, the latest tech news, and special interviews, every week.
One email a week. No spam, unsubscribe anytime.
Click Here For The Original Source.
——————————————————–
