Overnight on October 11 and 12, attackers manipulated the refrigeration controls at French supermarkets, and fresh and frozen food spoiled at many stores. France’s finance minister told Parliament that about 700 of the country’s 10,000 supermarkets were affected, far above the 300 to 350 that early reports suggested. Copeland, a US company, and its Dixell brand have since been named among the affected vendors, which gives this French supermarket fridge hack a direct American angle.
The attack is still developing. A criminal investigation is open, no group has claimed responsibility, and no one has been publicly attributed. The method is what should concern US readers most. The attackers did not need a customer database or a payment system to cause damage. They needed to reach controllers that were exposed to the internet and push them past safe temperatures.
What the French supermarket fridge hack did overnight
The damage came from temperature, not stolen records. Attackers reportedly stretched defrost cycles from about one hour to as long as eight hours, and some units reached 50°C, according to New Food Magazine. SecurityWeek reported that refrigeration at Intermarché ran at 50°C for six hours.
The financial toll is starting to come into focus. The Rundown AI reported that a store in Gradignan lost €21,000 in inventory, citing Le Monde, and that Intermarché estimated its losses at tens of millions of euros. Those figures come from secondary reporting, and the company has not published a detailed accounting.
The timeline moved quickly. ANSSI, the French cybersecurity agency, first flagged the compromises on October 12 in an alert that named Danfoss AK-SM and AK-SC controllers. A day later it extended the alert to cover Copeland XWEB and Dixell XWEB systems. On October 14, ANSSI said Copeland and Dixell equipment had also been hacked, according to Technology.org.
Which controllers and vendors are named
- Danfoss AK-SM and AK-SC controllers, named in the first ANSSI alert on October 12.
- Copeland XWEB and Dixell XWEB systems, added to the alert a day later.
- Copeland’s acknowledgment. The company acknowledged a “vulnerability” in a discontinued, end-of-life generation of controllers. Copeland told CNN: “We are currently working with impacted customers to mitigate the risk.”
- Danfoss’s explanation. The Danish firm said affected units ran outdated firmware or had reached end of life and no longer received security updates.
Dixell is an Italian brand that Copeland owns, according to CNN and Infosecurity Magazine. The split responsibility is already creating a blame question. Copeland points to a legacy product line, Danfoss points to firmware status, and a UK researcher suggested that either the Danish firm or the fridge installers may have placed the controllers on the public internet.
Why an internet-exposed fridge controller can spoil food
Remote monitoring was built for convenience. The controllers let maintenance firms adjust store refrigeration temperatures online, and that convenience created the exposure. Experts say some of these units were reachable from the public internet, which turned a service connection into an attack surface. A scan cited by Technology.org found at least 4,500 Danfoss interfaces still visible online.
This is an operational technology problem rather than a data breach. The victims lost inventory and faced food-safety disruption, not customer lists. That distinction matters for any US retailer whose incident plan is built mainly around customer data.
The pattern echoes other internet-facing equipment problems. Palo Alto’s PAN-OS zero-day, CVE-2026-0322, is a firewall flaw rather than a refrigeration issue, but the lesson is similar: equipment that answers requests from the open internet needs tight control. Infrastructure operators also face data-theft attacks, as the CenterPoint breach involving personal data of more than 1 million Texans showed. The French case is different because the damage was physical.
Which French chains confirmed affected stores
Intermarché reported about 150 affected stores, and Carrefour said 80 of its stores were impacted. Coopérative U said 80 of its 2,000 stores were affected. Netto, Monoprix and E.Leclerc have also confirmed affected stores, according to CBC News.
Dominique Schelcher, CEO of Coopérative U, said: “It is unprecedented, extremely serious, and unacceptable,” as AP reported. France’s finance minister, Roland Lescure, told Parliament: “It was a wake-up call for everyone.” He also said there was no risk to France’s food supply. The Paris prosecutor’s cybercrime unit opened an investigation.
Is my store’s fridge exposed? What operators should do now
Shoppers cannot inspect a supermarket’s controllers from the aisle. Operators, distributors and facilities teams can, and the steps are concrete. They draw on CERT-FR’s advice and on the vendors’ statements:
- Inventory every connected refrigeration controller, including vendor, model and firmware version.
- Confirm support status with the vendor. Danfoss said units with outdated firmware or end-of-life status no longer receive security updates, so those units need replacement plans.
- Remove direct internet exposure. CERT-FR advised operators to take these controllers off the public internet.
- Route remote access through a secure VPN or a protected network.
- Audit defrost and alarm settings for changes you did not make. Reported defrost cycles of eight hours make defrost schedules the first place to look.
No US advisory has surfaced in the coverage reviewed for this story, so operators should also watch their vendors’ support channels directly.
What remains unknown and what comes next
Several questions remain open. No group has claimed the attack, and the possibilities range from a lone hacker or hacktivist to a deliberate sabotage operation. ANSSI has reportedly identified a flaw in Danfoss software, but no official source has named it. A link between the attack and fires reported at some stores remains unproven. ANSSI warned on October 13 that attacks were probably continuing.
For US readers, the coverage reviewed here identifies no affected US stores and no advisory from CISA or the FBI. That is a gap, not proof of safety, since many controllers from these vendors are installed in North America.
Watch for four signals in the coming weeks: whether ANSSI names the flaw, whether Copeland and Danfoss issue firmware fixes or replacement programs for end-of-life units, what the Paris prosecutor’s investigation uncovers, and whether any US agency or vendor issues guidance. Each development would move this story from a French supply disruption toward a test case for any grocer running connected refrigeration.
