French prosecutors have opened a criminal cybercrime investigation into an attack that hit refrigeration systems at hundreds of supermarkets across the country, as the confirmed toll of affected stores climbed sharply this week. Finance Minister Roland Lescure told Parliament that roughly 700 of France’s 10,000 supermarkets were disrupted overnight between October 11 and 12, 2026, a figure that dwarfs earlier store-by-store estimates and has turned a regional refrigeration glitch into a national cybersecurity story.
The attack did not touch point-of-sale systems, loyalty databases, or payment rails. Instead, it reached into the industrial control hardware that keeps milk, meat, and seafood cold, forcing compromised units into defrost cycles or manually elevated temperature settings that in some stores climbed as high as 50°C (122°F), according to The Register. Food spoiled, some stores reported fires, and the Paris prosecutor’s cybercrime unit is now trying to work out exactly how it happened and who is responsible.
From 150 Stores to 700: How the Numbers Climbed
Early reporting in the days immediately after the October 11-12 incident pointed to a few hundred affected locations. By the time Lescure addressed lawmakers, that figure had grown substantially. The minister’s estimate of roughly 700 supermarkets, out of a national base of about 10,000, represents close to 7% of all French supermarkets experiencing some form of refrigeration disruption in a single overnight window.
That kind of jump between initial incident reports and a government tally is common in large-scale OT (operational technology) incidents, where affected retailers need days to audit every store’s equipment logs before a national number can be stated with confidence. A companion technical breakdown of the OT firmware gaps behind the incident examined why these controllers stayed exposed for so long. It also reflects how fragmented France’s supermarket sector is: no single company owns enough stores to see the full picture on its own, so the real scope only became visible once the Finance Ministry collected figures from every major chain.
Dominique Schelcher, chief executive of Coopérative U, described the incident in blunt terms, calling it “unprecedented, extremely serious, and unacceptable,” a characterization that captures how seriously French retailers are treating an attack that, on paper, only hit refrigerators.
Retailer by Retailer: Who Was Hit
Individual retailer disclosures paint a more granular picture than the national figure alone. Groupement Mousquetaires, the cooperative behind the Intermarché and Netto banners, said 300 of its stores were affected, by far the largest single-chain count disclosed so far. Coopérative U reported 80 affected stores. Carrefour said 80 of its roughly 6,000 French supermarkets were hit, while stressing that the vast majority of its network was untouched. Monoprix put its own number at approximately 30 stores. Several E.Leclerc locations were also affected, though no retailer-wide total has been confirmed for that chain.
| Retailer / Group | Stores Affected | Approx. Network Size | Share Affected |
|---|---|---|---|
| National estimate (French Finance Ministry) | ~700 | ~10,000 supermarkets | ~7% |
| Groupement Mousquetaires (Intermarché + Netto) | 300 | Not disclosed | Not disclosed |
| Coopérative U | 80 | Not disclosed | Not disclosed |
| Carrefour | 80 | ~6,000 | ~1.3% |
| Monoprix | ~30 | Not disclosed | Not disclosed |
| E.Leclerc | Several (no total confirmed) | Not disclosed | Not disclosed |
The gap between the national 700-store estimate and the sum of disclosed retailer figures (which adds up to well under 700 once E.Leclerc’s undisclosed count is excluded) suggests either additional unnamed chains were hit, or that some retailers have not yet released full figures. Either way, the discrepancy is itself a data point: a week after the attack, France still doesn’t have a single, reconciled count of exactly how many stores went dark on refrigeration.
How Refrigeration Hardware Became the Attack Surface
Supermarket refrigeration isn’t a single appliance. It’s a network of compressors, sensors, and controllers tied together by remote-monitoring software so chains can track temperatures across thousands of stores from a central office. That same remote-access convenience is what turned this into a cybersecurity incident rather than a maintenance problem.
France’s national cybersecurity agency said it was “aware of numerous compromises” involving remote-control modules made by two vendors: Danfoss and Copeland. Specifically, investigators pointed to Danfoss AK-SM and AK-SC controllers, alongside Copeland XWEB and Dixell XWEB systems (Dixell is a Copeland-owned brand). Attackers who gained access to these controllers could, in theory, push a unit into a continuous defrost cycle or simply override the temperature setpoint, which is consistent with the elevated temperatures retailers reported.
Legacy Equipment, Modern Consequences
Danfoss said the majority of the affected systems were older products that no longer receive software or security updates, a detail that reframes the story. This wasn’t necessarily a zero-day exploit against current hardware. It looks more like a fleet of aging, internet-connected industrial controllers that outlived their vendor’s patch cycle while remaining in daily operational use. According to AP News, Danfoss said it “has long advised customers to keep supported systems updated with the latest firmware, as well as to operate behind a firewall,” guidance that, if followed consistently across thousands of retail sites, might have narrowed the exposure.
That is the uncomfortable pattern behind a lot of industrial-control incidents: the hardware is built to run for a decade or more, but the security assumptions underneath it age out far faster. A controller installed in 2015 to manage a deli case doesn’t get replaced just because its firmware is no longer supported. It keeps running, keeps reporting to a central dashboard, and keeps listening on whatever network port it was configured with years ago.
| Vendor | Product Line Named | Status Reported | Named By |
|---|---|---|---|
| Danfoss | AK-SM controllers | Largely legacy, no longer receiving updates | French cybersecurity agency |
| Danfoss | AK-SC controllers | Largely legacy, no longer receiving updates | French cybersecurity agency |
| Copeland | XWEB monitoring systems | Identified in numerous compromises | French cybersecurity agency |
| Copeland (Dixell brand) | Dixell XWEB | Identified in numerous compromises | French cybersecurity agency |
Paris Prosecutors Open a Cybercrime Investigation
The Paris prosecutor’s office has opened an investigation through its cybercrime unit, describing the case, according to AFP, as “the large-scale cyberattack affecting the refrigerators of several major food retail chains across France.” The inquiry is meant to identify victims and establish the link between the intrusions and the damage retailers reported, including spoiled food and fires.
That framing matters. Prosecutors aren’t just investigating unauthorized computer access, which would be the standard charge in most intrusion cases. They’re explicitly trying to connect a digital intrusion to physical, real-world damage, which is a harder evidentiary chain to build and typically points to a longer, more resource-intensive investigation than a conventional credential-theft case like the LLM-jacking cloud credential thefts security teams have tracked this year.
As of this week, no individual or group had claimed responsibility, and prosecutors had not named any suspects. That silence is notable. Ransomware crews and hacktivist groups that go after visible, disruptive targets usually want credit, either for extortion leverage or publicity. The absence of a claim seven days in suggests this may not be a typical extortion play, or that whoever is behind it is deliberately staying quiet while the investigation is still forming.
No Attribution, No Ransom Note, No Clear Motive
Unlike many of the breach stories security desks cover week to week, this one lacks the usual markers that help investigators and reporters triage quickly: there’s no leak site posting stolen files, no ransom demand, and no dark-web forum post bragging about access. What’s confirmed is narrower: refrigeration controllers from two named vendors were compromised at scale, the effects were consistent across hundreds of stores, and the financial toll, while real, has not yet been quantified by any official body.
That gap between confirmed technical facts and unconfirmed motive is exactly what the Paris cybercrime unit is now working to close. Investigators will likely need to correlate network logs from Danfoss- and Copeland-linked systems across multiple retailers, a process complicated by the fact that each chain runs its own IT environment and may have varying levels of logging on equipment that, by Danfoss’s own account, predates current security monitoring standards.
Industry Reaction: “An Attack on the Food Supply Chain”
Schelcher’s comments as Coopérative U’s chief executive went further than a standard incident disclosure. According to ABC News, he said “targeting equipment essential to the preservation of fresh products is an attack on the French food supply chain,” rather than a narrow IT problem. That rhetoric, from the head of a retail cooperative with 80 affected stores, signals that French retailers see this as a supply-chain security failure, not simply a vendor patch gap.
It’s a useful reframing for readers outside France too. A refrigeration controller doesn’t look like critical infrastructure the way a power grid or a hospital network does, but food retail runs on exactly the kind of continuous, physically-grounded operations that make OT security different from office IT security. When a laptop gets ransomware, you restore from backup. When a case full of seafood sits at 50°C overnight, there’s no backup to restore.
Market and Business Impact
No official body has put a euro figure on the national financial loss, and retailers have been careful not to speculate publicly. What is clear is that the costs fall into at least three buckets: discarded inventory across several hundred stores, the labor and logistics required to restock and sanitize affected cases, and whatever Danfoss and Copeland now owe in remediation support to retail customers running their legacy controllers.
For the two named vendors, the reputational exposure may ultimately matter more than any single retailer’s spoiled-inventory bill. Danfoss and Copeland both sell into a global base of grocery, convenience, and cold-storage operators well beyond France, and an incident tied specifically to named product lines (AK-SM, AK-SC, XWEB, Dixell XWEB) creates an obvious incentive for operators everywhere to check whether their own units are still running unsupported firmware behind a weak or absent firewall. Expect procurement teams at major grocery chains outside France to start asking their refrigeration vendors pointed questions about patch status this quarter.
Insurers covering commercial property and business interruption for grocery chains are also watching closely. A cyber-triggered spoilage event is an unusual claim category, sitting somewhere between a traditional equipment-failure claim and a cyber-incident claim, and how French insurers adjudicate these losses will likely shape policy language for cold-chain operators elsewhere.
Historical Context: When OT Security Fails Quietly
Industrial control and building-management systems have long been treated as a lower security priority than core IT, in part because they were historically isolated from the open internet. That isolation has eroded over the past decade as vendors added remote monitoring for efficiency and maintenance convenience, the same convenience that gave this attack its reach across hundreds of stores simultaneously.
What distinguishes this incident from a typical retail data breach, like the kind covered in Meta’s recent GitHub exposure or the Zizzl LLC breach, is that no personal data appears to have been stolen at all. The damage here is entirely physical and operational: spoiled food, elevated temperatures, and reported fires, rather than exposed records sold on a forum. That makes it a useful case study for the gap between data-breach security and OT security, two disciplines that still get treated as separate problems inside most retail IT organizations.
How This Compares to Other Recent Critical-Infrastructure Incidents
Compared with the software-patch-driven incidents that dominate most weekly security roundups, such as the scale seen in Microsoft’s October Patch Tuesday, this attack is notable for hitting hardware that most IT security teams don’t directly manage. Refrigeration controllers typically sit under facilities or operations departments, not the CISO’s org chart, which can mean slower detection and a less mature incident-response playbook when something goes wrong.
It also differs from credential-driven breaches like the UK Legal Aid Agency hack or cloud-credential abuse cases, where the attacker’s goal is typically data exfiltration or resale. Here, the apparent goal, to the extent one can be inferred from the outcome, was disruption of physical equipment at scale. Whether that reflects extortion groundwork that stalled, a researcher’s uncoordinated disclosure gone wrong, or a deliberate act of sabotage is exactly what the Paris cybercrime unit will need to determine.
What Investigators Still Need to Determine
Several open questions remain unanswered in the days since the attack. First, how the attackers gained access to controllers across multiple, unrelated retail chains simultaneously, whether through a shared vendor cloud service, exposed remote-management ports, or compromised third-party maintenance contractors. Second, whether the same campaign touched refrigeration systems outside France, given that Danfoss and Copeland equipment is used by grocery chains across Europe and beyond. Third, whether any ransom demand was made privately to individual retailers or vendors even though nothing has surfaced publicly.
According to CNN, the Paris prosecutor’s office said “the investigation will identify the victims and establish the link between the attacks and the damage they reported, in terms of food spoilage and fires,” which suggests investigators themselves are still building the full victim list rather than working from a complete one.
Predictions: Where This Story Goes From Here
- Expect the confirmed store count to shift again as more retailers finish internal audits. The 700 figure is likely a snapshot, not a final number.
- Danfoss and Copeland will face pressure from customers well beyond France to publish clear end-of-life and patch guidance for AK-SM, AK-SC, and XWEB product families.
- Grocery and cold-chain operators in other EU countries will likely run their own internal audits of exposed refrigeration controllers in the coming weeks, prompted by this incident.
- The Paris investigation will probably take months to produce a public attribution, if one comes at all, given the difficulty of tracing distributed intrusions across many independently-run retail IT environments.
- Expect this incident to become a reference case in EU discussions of critical-infrastructure and supply-chain cybersecurity rules, given how cleanly it illustrates the risk of unsupported OT hardware tied to the internet.
What Retailers and OT Operators Should Do Now
For any retailer or facilities team running Danfoss or Copeland refrigeration controllers, or comparable remote-monitored industrial equipment from other vendors, the immediate priority is an inventory check: which units are still on supported firmware, which sit behind a firewall, and which are reachable from the open internet at all. Danfoss’s own guidance, to keep systems updated and operate behind a firewall, is a reasonable baseline, but it only works if someone has actually verified that every store location follows it, not just the flagship sites that get the most attention.
Segmenting OT networks from corporate IT, auditing remote-access credentials used by vendor maintenance contractors, and setting up basic anomaly alerts for temperature setpoint changes are all steps that would have blunted this specific attack pattern. None of that is exotic. It’s the same operational hygiene that’s been recommended for industrial control systems for years. This incident is simply the latest, highly visible reminder of what happens when it’s skipped at scale.
Frequently Asked Questions
How many French supermarkets were affected by the cyberattack?
French Finance Minister Roland Lescure told Parliament that roughly 700 of France’s approximately 10,000 supermarkets were affected by the overnight October 11-12, 2026 incident.
Which retailers confirmed they were hit?
Groupement Mousquetaires (Intermarché and Netto) reported 300 affected stores, Coopérative U reported 80, Carrefour reported 80 of its roughly 6,000 stores, Monoprix reported about 30, and several E.Leclerc locations were also affected without a confirmed chain-wide total.
What equipment was compromised?
France’s cybersecurity agency identified compromises involving Danfoss AK-SM and AK-SC controllers, along with Copeland XWEB and Dixell XWEB monitoring systems. Dixell is a brand owned by Copeland.
How hot did the refrigeration units get?
Affected systems were reportedly forced into defrost cycles or had temperature settings changed manually, with some reaching approximately 50°C (122°F), according to retailer and reporting figures.
Has anyone claimed responsibility for the attack?
No individual or group had publicly claimed responsibility as of this reporting, and the Paris prosecutor’s office had not named any suspects.
Who is investigating the attack?
The Paris prosecutor’s office opened a cybercrime investigation, stating it would work to identify victims and establish the link between the intrusions and the reported damage, including food spoilage and fires.
Why were older refrigeration controllers vulnerable?
Danfoss said most of the affected systems were older products that no longer receive software or security updates, meaning they lacked current firmware protections despite still being connected for remote monitoring.
Has the financial cost of the attack been calculated?
No. As of this reporting, the national financial loss from spoiled food and related damage had not been established by any official body.