FRANCE’S national cybersecurity agency ANSSI and CERT-FR say a cyberattack disrupting supermarket refrigeration has widened to affect Copeland XWEB and Dixell XWEB controllers, in addition to earlier Danfoss AK-SM and AK-SC units. In total, around 700 of France’s roughly 10,000 supermarkets were impacted, with chains including Carrefour, Coopérative U, E[.]Leclerc, Intermarché and Monoprix confirming involvement.
ANSSI first warned on 12 October of compromises linked to Danfoss AK-SM and AK-SC series, updating the alert a day later to include Copeland XWEB and Dixell XWEB systems. Copeland has acknowledged a vulnerability and is working with affected customers to mitigate risk, while Danfoss notes that most affected devices are older AK-SM 800 and AK-SC 355 models that reached end of life and are no longer patched; some still-running AK-SM 800A units with outdated firmware were also affected.
Investigators say the method of intrusion remains unclear, with the CERT-FR alert not tying compromises to a specific vulnerability and no claim of responsibility or ransom demand having been reported. The attack forced operational disruptions including prolonged defrost cycles, alarms delayed, and in at least one location, stores experiencing temperatures as high as 50°C and resulting food waste.
French authorities have opened a cybercrime inquiry, and operators are urged to remove affected controllers from the internet, restoring remote access only through secure VPNs orprotected networks. For end-of-life devices, factory resets are deemed insufficient if exposure persists. Censys reported thousands of internet-exposed Danfoss StoreView panels, with counts fluctuating as systems were disconnected or updated.