# Hackers Overheat French Supermarket Fridges as Copeland, Dixell Named

- URL: https://usa-24.com/french-supermarket-fridge-hack/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-16T13:37:09.141Z
- Updated: 2026-10-16T13:59:51.318Z
- Topics: Cybersecurity, Industrial Control Systems, Critical Infrastructure, Copeland, Danfoss

> Attackers manipulated refrigeration controllers at about 700 French supermarkets, and US-based Copeland and its Dixell brand are now among the affected vendors.

## Key takeaways

- An overnight attack on October 11 and 12 manipulated refrigeration controls at about 700 of France’s 10,000 supermarkets, according to the finance minister.
- Copeland acknowledged a vulnerability in a discontinued, end-of-life generation of controllers, and Danfoss said affected units ran outdated firmware or had reached end of life.
- Attackers reportedly stretched defrost cycles from about one hour to as long as eight hours, and some units reached 50°C.
- CERT-FR advised operators to remove direct internet exposure of these controllers and to route remote access through secure VPNs or protected networks.
- No group has claimed responsibility and no ransom demand has been reported, and coverage reviewed for this story documents no affected US stores.

Overnight on October 11 and 12, attackers manipulated the refrigeration controls at French supermarkets, and fresh and frozen food spoiled at many stores. France’s finance minister told Parliament that about 700 of the country’s 10,000 supermarkets were affected, far above the 300 to 350 that early reports suggested. Copeland, a US company, and its Dixell brand have since been named among the affected vendors, which gives this French supermarket fridge hack a direct American angle.

The attack is still developing. A criminal investigation is open, no group has claimed responsibility, and no one has been publicly attributed. The method is what should concern US readers most. The attackers did not need a customer database or a payment system to cause damage. They needed to reach controllers that were exposed to the internet and push them past safe temperatures.

## What the French supermarket fridge hack did overnight

The damage came from temperature, not stolen records. Attackers reportedly stretched defrost cycles from about one hour to as long as eight hours, and some units reached 50°C, according to [New Food Magazine](https://www.newfoodmagazine.com/news/cyberattack-sends-supermarket-fridges-to-50c-as-700-french-stores-hit/2136741.article). [SecurityWeek](https://www.securityweek.com/supermarket-refrigeration-attack-widens-to-copeland-dixell-controllers/) reported that refrigeration at Intermarché ran at 50°C for six hours.

The financial toll is starting to come into focus. [The Rundown AI](https://www.therundown.ai/news/french-supermarket-refrigeration-cyberattack) reported that a store in Gradignan lost €21,000 in inventory, citing Le Monde, and that Intermarché estimated its losses at tens of millions of euros. Those figures come from secondary reporting, and the company has not published a detailed accounting.

The timeline moved quickly. ANSSI, the French cybersecurity agency, first flagged the compromises on October 12 in an alert that named Danfoss AK-SM and AK-SC controllers. A day later it extended the alert to cover Copeland XWEB and Dixell XWEB systems. On October 14, ANSSI said Copeland and Dixell equipment had also been hacked, according to [Technology.org](https://www.technology.org/2026/10/14/french-supermarket-fridge-hack-copeland-dixell-anssi/).

## Which controllers and vendors are named

- **Danfoss AK-SM and AK-SC controllers**, named in the first ANSSI alert on October 12.
- **Copeland XWEB and Dixell XWEB systems**, added to the alert a day later.
- **Copeland’s acknowledgment.** The company acknowledged a “vulnerability” in a discontinued, end-of-life generation of controllers. Copeland told CNN: “We are currently working with impacted customers to mitigate the risk.”
- **Danfoss’s explanation.** The Danish firm said affected units ran outdated firmware or had reached end of life and no longer received security updates.

Dixell is an Italian brand that Copeland owns, according to [CNN](https://www.cnn.com/2026/10/14/europe/france-cyberattack-supermarket-fridges-intl) and [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/french-supermarket-hack-more/). The split responsibility is already creating a blame question. Copeland points to a legacy product line, Danfoss points to firmware status, and a UK researcher suggested that either the Danish firm or the fridge installers may have placed the controllers on the public internet.

## Why an internet-exposed fridge controller can spoil food

Remote monitoring was built for convenience. The controllers let maintenance firms adjust store refrigeration temperatures online, and that convenience created the exposure. Experts say some of these units were reachable from the public internet, which turned a service connection into an attack surface. A scan cited by Technology.org found at least 4,500 Danfoss interfaces still visible online.

This is an operational technology problem rather than a data breach. The victims lost inventory and faced food-safety disruption, not customer lists. That distinction matters for any US retailer whose incident plan is built mainly around customer data.

The pattern echoes other internet-facing equipment problems. Palo Alto’s [PAN-OS zero-day, CVE-2026-0322](https://usa-24.com/palo-alto-pan-os-zero-day/), is a firewall flaw rather than a refrigeration issue, but the lesson is similar: equipment that answers requests from the open internet needs tight control. Infrastructure operators also face data-theft attacks, as the [CenterPoint breach](https://usa-24.com/centerpoint-energy-data-breach-texans/) involving personal data of more than 1 million Texans showed. The French case is different because the damage was physical.

## Which French chains confirmed affected stores

Intermarché reported about 150 affected stores, and Carrefour said 80 of its stores were impacted. Coopérative U said 80 of its 2,000 stores were affected. Netto, Monoprix and E.Leclerc have also confirmed affected stores, according to [CBC News](https://www.cbc.ca/news/business/france-fridge-hack-smart-devices-food-system-9.7379613).

Dominique Schelcher, CEO of Coopérative U, said: “It is unprecedented, extremely serious, and unacceptable,” as [AP reported](https://abcnews.com/Business/wireStory/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-137230099). France’s finance minister, Roland Lescure, told Parliament: “It was a wake-up call for everyone.” He also said there was no risk to France’s food supply. The Paris prosecutor’s cybercrime unit opened an investigation.

## Is my store’s fridge exposed? What operators should do now

Shoppers cannot inspect a supermarket’s controllers from the aisle. Operators, distributors and facilities teams can, and the steps are concrete. They draw on CERT-FR’s advice and on the vendors’ statements:

1. Inventory every connected refrigeration controller, including vendor, model and firmware version.
2. Confirm support status with the vendor. Danfoss said units with outdated firmware or end-of-life status no longer receive security updates, so those units need replacement plans.
3. Remove direct internet exposure. CERT-FR advised operators to take these controllers off the public internet.
4. Route remote access through a secure VPN or a protected network.
5. Audit defrost and alarm settings for changes you did not make. Reported defrost cycles of eight hours make defrost schedules the first place to look.

No US advisory has surfaced in the coverage reviewed for this story, so operators should also watch their vendors’ support channels directly.

## What remains unknown and what comes next

Several questions remain open. No group has claimed the attack, and the possibilities range from a lone hacker or hacktivist to a deliberate sabotage operation. ANSSI has reportedly identified a flaw in Danfoss software, but no official source has named it. A link between the attack and fires reported at some stores remains unproven. ANSSI warned on October 13 that attacks were probably continuing.

For US readers, the coverage reviewed here identifies no affected US stores and no advisory from CISA or the FBI. That is a gap, not proof of safety, since many controllers from these vendors are installed in North America.

Watch for four signals in the coming weeks: whether ANSSI names the flaw, whether Copeland and Danfoss issue firmware fixes or replacement programs for end-of-life units, what the Paris prosecutor’s investigation uncovers, and whether any US agency or vendor issues guidance. Each development would move this story from a French supply disruption toward a test case for any grocer running connected refrigeration.

## Frequently asked questions

### Is my grocery store fridge hackable?

Refrigeration controllers can be targeted when they are reachable from the public internet, and some units in this attack were exposed that way, according to CNN. CERT-FR advised operators to remove direct internet exposure and to route remote access through secure VPNs or protected networks. Ask your facilities team or refrigeration vendor whether any controllers answer connections from outside your network and whether their firmware is still supported.

### Which fridge controllers were affected in the French supermarket attack?

ANSSI first named Danfoss AK-SM and AK-SC controllers on October 12, then extended its alert to Copeland XWEB and Dixell XWEB systems. Copeland acknowledged a vulnerability in a discontinued, end-of-life generation of controllers. Danfoss said affected units ran outdated firmware or had reached end of life.

### Did the French supermarket fridge hack affect US stores?

No source reviewed for this story reports US stores affected, and no CISA or FBI guidance has been reported. Copeland is a US company, and US grocers and distributors that use Danfoss, Copeland or Dixell controllers face similar exposure in principle. Operators should check their own inventories rather than assume they are safe.

### Who is behind the attack on French supermarket refrigeration?

No group has claimed responsibility, and no ransom demand has been reported. The Paris prosecutor’s cybercrime unit has opened an investigation, but no attribution has been made public. Investigators have not yet confirmed which vulnerability was exploited.

## Sources

1. [What to know about the cyberattack that targeted supermarket refrigeration systems in France](https://www.cnn.com/2026/10/14/europe/france-cyberattack-supermarket-fridges-intl)
2. [Cyberattack targeting refrigeration systems hits 700 supermarkets](https://abcnews.com/Business/wireStory/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-137230099)
3. [Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers](https://www.securityweek.com/supermarket-refrigeration-attack-widens-to-copeland-dixell-controllers/)
4. [French Supermarket Cyber-Attack Impacts More Refrigeration Controllers](https://www.infosecurity-magazine.com/news/french-supermarket-hack-more/)
5. [French Supermarket Fridge Hack Also Hit Copeland and Dixell Systems, ANSSI Says](https://www.technology.org/2026/10/14/french-supermarket-fridge-hack-copeland-dixell-anssi/)
6. [Hackers sabotage refrigeration at hundreds of French supermarkets](https://www.therundown.ai/news/french-supermarket-refrigeration-cyberattack)
7. [Cyberattack sends supermarket fridges to 50°C as 700 French stores hit](https://www.newfoodmagazine.com/news/cyberattack-sends-supermarket-fridges-to-50c-as-700-french-stores-hit/2136741.article)
8. [How did hackers overheat French supermarket fridges — and could we see more cyberattacks on the food system?](https://www.cbc.ca/news/business/france-fridge-hack-smart-devices-food-system-9.7379613)