French supermarket refrigeration attack widens to Copeland and Dixell controllers

The cyberattack that disrupted refrigeration systems at French supermarkets has spread beyond Danfoss equipment. France's national cybersecurity agency ANSSI, through its CERT-FR team, updated its alert on October 13 to add Copeland XWEB and Dixell XWEB controllers to the list of targeted devices, according to the alert and reporting by SecurityWeek. The number of affected stores has also grown to about 700, making the incident one of the most disruptive attacks on operational technology in European retail this year.

What happened

CERT-FR first warned on October 12 of numerous compromises involving remote controllers for refrigeration installations, specifically the Danfoss AK-SM and AK-SC series. The October 13 update of alert CERTFR-2026-ALE-012 added Copeland xweb and Dixell xweb equipment. According to SecurityWeek, Copeland initially declined to confirm the findings but later acknowledged a vulnerability, saying it was working with impacted customers to mitigate the risk.

Finance Minister Roland Lescure told lawmakers that about 700 of France's roughly 10,000 supermarkets were affected, SecurityWeek reported, up from earlier estimates of 300 to 350. Carrefour, Coopérative U, E.Leclerc, Intermarché and Monoprix are among the confirmed affected chains. Intermarché said about 150 of its stores were hit and all food in them was discarded, while Carrefour reported 80 affected stores. The Paris prosecutor's cybercrime unit has opened an investigation.

Technical details

CERT-FR has not tied the compromises to a specific vulnerability and has not described the attack method. According to Le Monde, as cited by SecurityWeek, attackers extended defrost cycles from one hour to as many as eight, delaying alarms. Danfoss said most affected devices were older AK-SM 800 and AK-SC 355 systems that are end-of-life and no longer receive patches, although some current AK-SM 800A units running outdated firmware were also hit.

Censys data cited by SecurityWeek showed nearly 3,000 internet-exposed Danfoss StoreView panels on October 11, more than 1,800 of them in France. By October 14, the French count had dropped to 537. Censys noted that operators appear to be disconnecting controllers rather than updating them. Sekoia researcher Félix Aimé told Reuters that stores in Spain, Portugal, Poland, Germany and Belgium were also affected, without giving details. No group has claimed responsibility and no ransom demand has been reported.

What to do

CERT-FR recommends that operators of the affected equipment:

• remove all affected units from direct internet exposure and restore remote access only through a secure VPN or protected network;
• review the full configuration, especially defrost schedules;
• apply vendor guidance, including firmware updates and, for Danfoss, the Strict security level and changed default passwords;
• factory reset and reconfigure compromised devices before returning them to service.

The agency warns that attack campaigns are likely still ongoing and that a factory reset alone is not enough for end-of-life devices, which remain vulnerable to reinfection if they stay exposed.