Supermarket refrigeration attack spreads to Copeland, Dixell

The cyberattack that disrupted refrigeration in French supermarkets is larger than first reported. Equipment from Copeland and its Dixell brand was also hit, not only Danfoss controllers, according to ANSSI, France's national cybersecurity agency.

CERT-FR, ANSSI's computer emergency response team, first warned on October 12 of numerous compromises of Danfoss AK-SM and AK-SC series refrigeration controllers. The next day it updated the alert to add Copeland XWEB and Dixell XWEB systems.

Copeland at first would not confirm the agency's findings. It has since acknowledged a vulnerability. "We are currently working with impacted customers to mitigate the risk," the company said.

How the attackers got in is still unclear

The entry point remains unknown. The CERT-FR alert does not tie the compromises to a specific vulnerability. Neither Danfoss nor French authorities have linked the attack to the flaws Claroty disclosed earlier this year.

This summer, Claroty published details of flaws in Danfoss's AK-SM 800A controller and 23 vulnerabilities in Copeland's XWEB Pro controller. Copeland fixed those in a firmware update.

Danfoss said most of the affected devices are older AK-SM 800 and AK-SC 355 systems. Both have reached end of life and no longer get patches. Support for the AK-SM 800 ended in May 2021, and the AK-SC 355 was discontinued in 2016. Some current AK-SM 800A controllers were also compromised because they were running outdated firmware.

What CERT-FR wants operators to do

The agency told operators of affected controllers to disconnect them from the internet. Remote access should be restored only through a secure VPN or a protected network. Filtering connections by IP address is acceptable only as a temporary emergency measure.

CERT-FR also warned that a factory reset is not enough for compromised end-of-life devices. If such a device stays exposed, it remains vulnerable and will likely be compromised again.

Around 700 French stores affected

Carrefour, Coopérative U, E.Leclerc, Intermarché and Monoprix have confirmed they were affected. Finance Minister Roland Lescure told lawmakers on Tuesday that about 700 of France's roughly 10,000 supermarkets were hit. Earlier reports had put the figure at 300 to 350.

Les Mousquetaires, the group that owns Intermarché, said about 150 of its stores were affected. Refrigeration units there ran at 50 degrees Celsius for six hours, and all the food was thrown out. Carrefour reported 80 impacted stores.

Coopérative U CEO Dominique Schelcher said 80 of the group's stores were targeted, but only a minority had to discard products. Two supermarkets in Alsace reported combined losses of EUR 270,000 ($300,000).

The Paris prosecutor's office, whose cybercrime unit has opened an investigation, said the attack caused fires as well as food losses. Le Monde reported that the attackers stretched defrost cycles from one hour to as long as eight, which delayed alarms.

Citing a source familiar with the probe, Reuters reported that investigators are puzzled because there has been no claim of responsibility and no ransom demand.

Beyond France

Félix Aimé of Sekoia told Reuters that stores in Spain, Portugal, Poland, Germany and Belgium were also affected, though he did not give details. The Dutch NCSC said it did not believe a separate cyberattack on Ahold Delhaize was linked to the refrigeration incidents.

Censys counted nearly 3,000 Danfoss StoreView control panels exposed to the internet on October 11, more than 1,800 of them in France. By October 14, the French figure had fallen to 537, while the count in other countries barely changed.

Patched and unpatched versions dropped off at about the same rate. Censys said this suggests operators are pulling the controllers offline rather than updating them.

The incident has also raised the question of who is responsible. According to Bloomberg, Les Mousquetaires said Danfoss managed the refrigeration systems, so it is up to the supplier to file a complaint with the authorities.

Our Take

This incident shows what happens when building management equipment ends up connected to the internet for years after the vendor has stopped caring for it. Much of the affected hardware is end-of-life, and some of it was discontinued a decade ago. The problem matches a pattern we have covered before: legacy equipment in OT networks often goes unseen and unmanaged until something breaks.

The Censys data deserves attention. A sharp drop in exposed panels in France, with almost no change elsewhere, suggests that operators outside France may not yet see themselves at risk. That is a concern, given reports of affected stores in several other European countries. Disconnecting devices is a sensible first step, but it does not fix the underlying weakness.

The missing ransom demand and the absence of any claim are unusual. They leave the motive open, and the longer defrost cycles that delayed alarms suggest the attackers understood how these systems behave. The dispute over liability between retailers and suppliers may matter as much as the technical response, because managed-service arrangements can leave it unclear who owns patching and exposure.

It is worth watching whether investigators link the attack to the Claroty-disclosed flaws, whether more vendors turn up in CERT-FR's alert, and whether regulators push harder on rules for operational technology. In the US, CISA has already been urged to issue a binding OT directive, and this case is likely to add weight to that kind of call.