France’s national cybersecurity agency is warning that attacks on commercial refrigeration controllers are probably still underway after hundreds of supermarkets lost control of cooling systems. The campaign has compromised remote-management equipment from Danfoss, Copeland and Dixell, turning an ordinary maintenance interface into a direct route to defrost schedules, temperature settings and store inventory.
About 700 of France’s roughly 10,000 supermarkets were affected, Finance Minister Roland Lescure told lawmakers. At some locations, cabinet temperatures climbed as high as 50 degrees Celsius (122 degrees Fahrenheit) for roughly six hours. Stores discarded fresh and frozen products, and Intermarché put its one-day losses in the tens of millions of euros, according to Associated Press reporting.
The attacker and entry method have not been publicly identified. There has been no public ransom demand or credible claim of responsibility. French authorities have also cautioned against linking the refrigeration compromises to a separate disruption at Ahold Delhaize, whose brands include Albert Heijn, Stop & Shop, Food Lion and Giant.
What is clear is the recovery problem. In its alert updated October 16, CERT-FR said a factory reset can remove persistence from a compromised controller but is not sufficient if the same unsupported or unpatched device goes back online. An exposed controller can simply be compromised again.
Why a refrigeration controller can spoil an entire store
Commercial refrigeration is usually arranged as a hierarchy. A supervisory controller connects to the store network and provides a web console for technicians. Below it, field controllers operate individual cabinets and equipment such as compressors, cooling fans and defrost heaters. That design lets a service provider monitor alarms and change settings remotely across many sites, but it also puts physical control behind a web interface.
Claroty’s Team82 demonstrated the consequence with a Copeland XWEB Pro connected over serial Modbus to a field controller. From the compromised XWEB unit, the researchers could change the displayed temperature and operate the compressor, fans, defrost cycle and lighting. Their proof of concept could even continue showing the real probe reading while disabling cooling, allowing contents to warm without an obvious false value on the local display.
That laboratory chain is not proof that the same vulnerabilities were used in France. Claroty has explicitly said the precise attack path remains unconfirmed. It does, however, show why a reachable supervisory controller is an operational safety issue rather than just another web-admin panel.
The known exposure goes beyond one vendor
CERT-FR has identified compromises involving Danfoss AK-SM and AK-SC series equipment as well as Copeland and Dixell XWEB systems. The agency added the XWEB families to its alert a day after the initial notice, then expanded its recovery guidance on October 16.
Danfoss told Reuters that many affected units were end-of-life products that no longer received software or security updates, or were running old firmware. The company urged customers to keep supported systems current and migrate legacy equipment. Copeland similarly described the affected equipment as a discontinued generation and said it was working with customers.
Recent research explains the concern. Team82 found 2,765 internet-accessible Danfoss AK-SM 800A interfaces during its earlier scan. The flaws it disclosed included CVE-2025-41450, an authentication bypass involving a predictable “code of the day,” and CVE-2025-41451, a post-authentication command-injection path. Danfoss addressed the reported issues in firmware 4.3.1.
On Copeland XWEB Pro, Team82 documented 23 vulnerabilities, 21 rated high severity. The affected XWEB 300D Pro, 500D Pro and 500B Pro releases through 1.12.1 included an authentication logic error, predictable daily administrator credentials and multiple command-injection routes. Copeland fixed the set in firmware 1.13. One critical issue, CVE-2026-21718, was rated 10.0 and could lead from authentication bypass to pre-authentication code execution.
Exposure persists after the patches became available. Reuters found at least 4,500 Danfoss interfaces visible through Shodan on October 13, although it could not determine how many were vulnerable. French scanning company Onyphe found that older versions remained widely represented among public interfaces.
What operators should do now
The response order matters because stores must preserve evidence, protect food and keep service technicians connected without returning a vulnerable controller to the open internet.
1. Find every controller and every route into it
Inventory Danfoss AK-SM and AK-SC units and all Copeland or Dixell XWEB systems, including equipment managed by refrigeration contractors. Record model, serial number, firmware, public IP, network segment, service provider and support status. Check firewalls, routers and cloud gateways for port forwards, one-to-one NAT, remote-access appliances and temporary rules that may not appear in the controller’s own settings.
Do not assume that “behind a router” means unreachable. Verify exposure from outside the store network and ask service providers which addresses, accounts and management platforms they use across customer sites.
2. Remove direct internet exposure before recovery
CERT-FR’s first containment step is to remove affected units, and any similar units on public IP addresses, from direct internet exposure. Restore remote access only through a secured VPN or protected management network. Source-IP filtering for the refrigeration contractor can be a temporary measure, but the agency does not consider it a durable fix.
The alert also tells operators to check insurance terms before interrupting telemetry to their refrigeration provider. That is an unusual but practical warning: containment can affect monitoring obligations, maintenance contracts and the evidence needed for a claim.
3. Preserve the record before resetting
Before rebooting or factory-resetting a suspected unit, save its configuration, firmware version, user list, alarm history, audit data and current schedules where doing so will not prolong unsafe operation. Preserve firewall, VPN, DNS, proxy and service-provider logs, along with photographs or screenshots of changed setpoints and alarms. Normalize timestamps and note any clock drift on the embedded device.
A reset may erase useful device-level evidence. It also will not show whether a shared contractor account, remote-access gateway or reused password exposed several stores. Investigators need both the controller record and the surrounding network history.
4. Verify physical settings with independent measurements
Review temperature thresholds, defrost windows, alarm recipients, notification routes, operating schedules, users and permissions. Compare the controller’s values with calibrated external probes and cabinet-level observations. The XWEB research showed that an attacker with sufficient control can manipulate the display while changing the equipment state, so a plausible on-screen number is not enough for food-safety decisions.
5. Patch supported devices and replace unsupported ones
Move supported Danfoss AK-SM 800A deployments to firmware 4.3.1 or later and Copeland XWEB Pro systems to 1.13 or later, subject to vendor guidance for the exact model. CERT-FR also recommends Danfoss Strict security mode and replacement of default passwords.
For a compromised Danfoss unit, the agency advises a reboot and, if necessary, a factory reset before reconfiguration. But it is explicit that an end-of-life controller without a security fix should not be returned to the internet. If the vendor cannot provide a supported release for the installed hardware, isolation is an interim control; replacement is the durable answer.
6. Rebuild remote access around named identities
Give each contractor and technician an individual account with the minimum permissions required. Remove default and shared credentials, rotate passwords used across stores, and protect VPN access with multifactor authentication. Restrict the management network’s inbound and outbound connections, and alert on new users, authentication from unfamiliar locations, schedule changes and setpoints outside an approved range.
For multi-site operators, central monitoring should flag simultaneous changes across stores. A midnight defrost adjustment at one site may be maintenance; the same action across dozens of unrelated locations is an incident.
A factory reset closes only one part of the incident
The French attacks exposed a recurring weakness in operational technology: remote maintenance often survives for years after the hardware and its security model have aged out. The controller still keeps food cold, so replacement is deferred. The public web interface still saves a technician’s trip, so it remains reachable. When a patch finally exists, the refrigeration contractor, franchisee and retailer may each assume someone else owns the update.
That division of responsibility is why the most important line in CERT-FR’s guidance is not simply “patch.” A reset can remove persistence, but it cannot repair an unsupported product, close a public firewall rule or redesign a service provider’s access. Recovery is complete only when the physical process is verified, the controller is on a supported release, and remote administration no longer depends on an exposed web console.
