France’s national CERT has widened its alert on the supermarket refrigeration attacks to cover Copeland XWEB and Dixell XWEB supervisors, after an E.Leclerc store running Dixell kit lost control of its cold chain in the early hours of 13 October. Reuters reports that retailers in six more European countries were affected, and the Paris prosecutor and ANSSI are now both investigating.
What happened
On Tuesday 13 October, CERT-FR updated its advisory on the refrigeration incidents to say it is aware of numerous compromises involving Copeland XWEB and Dixell XWEB, the web-based supervisory platforms that monitor and control commercial refrigeration and HVAC. The update suggests that products from more than one vendor were abused in the same campaign window.
The first public sign of the shift came from an E.Leclerc store near Albi, which uses Dixell equipment. According to Cybernews, the store director said staff found the refrigeration control computers could not be operated at around 4am on Tuesday. Industry accounts cited by the same outlet describe dozens of operating parameters being altered remotely at some Dixell sites, and Dixell France has reportedly begun sending security notices about XWEB supervisors to customers. Copeland, which owns the Dixell brand, has not publicly confirmed a compromise.
The geography has also grown. SecurityWeek, citing Reuters, reports that France bore the brunt, but grocers in Spain, Portugal, Poland, Germany, Belgium and the Netherlands were affected too. On the legal side, the Paris prosecutor’s office has opened a criminal investigation, with prosecutors citing food losses and fires among the damage, and Prime Minister Sébastien Lecornu has instructed ANSSI to establish whether other organisations were exposed.
A further detail supports the multi-vendor picture: Coopérative U’s chief executive, Dominique Schelcher, told French radio that the group is not a Danfoss customer, even though around 80 of its stores were affected. The earlier wave, first reported on 12 October, centred on Danfoss AK-SM controllers; that part of the story has been covered previously and is not repeated here.
The technical picture
Nobody has yet published the initial access route. A source close to the Prime Minister has said ANSSI found a flaw in Danfoss software, but no known vulnerability has been publicly confirmed as the way in. What the evidence does show is a consistent operating pattern. According to Le Monde, as reported by eSecurity Planet, the attackers did not simply switch units off. They stretched defrost cycles to eight hours instead of one, which pushed temperatures up while delaying the alarms that would normally wake a duty engineer. Some cold rooms reportedly reached 50°C, and in at least one store a sprinkler was triggered.
That is deliberate, process-aware tampering, timed for overnight hours when stores are unstaffed. Changing many setpoints across many sites in one night is also consistent with scripted access to management interfaces, not hands-on keyboard work at each location.
The exposure is real for both vendors. Claroty’s Team82 disclosed 23 vulnerabilities in Copeland XWEB in August, 21 rated high severity, which in combination could take an unauthenticated attacker to root-level code execution. Copeland shipped fixes in a February firmware update. Cybernews separately reports a serious Dixell controller flaw that Copeland has confirmed and is still fixing. On the Danfoss side, the vendor says affected sites included end-of-life AK-SM800 units and newer models running outdated software. CERT-FR also warns that a factory reset on its own will not protect an unsupported device that stays reachable from the internet.
Why it matters for UK organisations
These are not obscure French products. Danfoss and Copeland equipment is sold worldwide through original equipment manufacturers, wholesalers and refrigeration contractors, so UK grocers, cold-storage operators, pharmacies, hospitals and hospitality groups may well be running XWEB or AK-SM supervisors without the security team knowing. In my experience, these boxes are usually bought, installed and maintained by facilities or a refrigeration contractor, and they rarely appear on the IT asset register.
The spread into a second vendor and at least seven countries changes the risk calculation. A campaign that started as one product problem now looks like an actor, or several, systematically working through internet-exposed building management interfaces. The NCSC warned in August that it had seen increased targeting of operational technology across sectors, including in the UK, and told organisations not to assume their OT is unreachable from the internet without checking. This week’s events are a concrete example of that warning.
Food retail is not an essential service under the NIS Regulations, but cold-chain failure at scale has clear public safety consequences, and data centres and hospitals use the same class of kit. Boards that have treated refrigeration as a facilities cost line should now see it as a cyber-physical risk.
Expert view
When we test retail and logistics estates, the building management layer is consistently one of the weakest areas. Web consoles with vendor default credentials, remote access left open for a contractor years ago, and firmware that nobody has updated since commissioning are all common findings. Remote access exists for a good reason, cutting maintenance costs, but that convenience is rarely matched by proper access control.
The defrost-cycle technique deserves attention. An attacker who understands the process can do serious physical damage while holding off the alarms, which means monitoring that relies only on the controller’s own alerts can come too late. Independent temperature sensing, on a separate path, is the control that would have caught this early.
I would be careful not to read too much into attribution. No group has claimed responsibility and no authority has named a suspect. Whether this is a sabotage campaign, a hacktivist operation or opportunists piling in after the first headlines, the defensive answer is the same.
What to do now
- Find the kit. Ask facilities and refrigeration contractors for a list of every Copeland XWEB, Dixell XWEB and Danfoss AK-SM or AK-SC supervisor, with firmware versions. Check your external attack surface tooling and Shodan or Censys for your own IP ranges.
- Take it off the internet today. No management interface should be directly reachable. This maps to the Cyber Essentials firewalls control: block inbound access at the boundary by default.
- Put remote access behind a proper gateway. Use a VPN or managed industrial remote access service with MFA and named accounts for each contractor (Cyber Essentials user access control).
- Change default and shared credentials on every controller, and review for unknown accounts (Cyber Essentials secure configuration).
- Patch or replace. Apply Copeland’s XWEB firmware and Danfoss’s current releases. Plan to retire end-of-life units; Cyber Essentials expects unsupported devices to be removed or segregated from the in-scope network (security update management).
- Add independent temperature alarms that do not depend on the supervisory system, and alert on configuration changes such as altered defrost durations.
- If you suspect compromise, follow CERT-FR’s advice: isolate, reset, patch, rotate credentials, check accounts and rebuild the configuration from a known-good record. Report to the NCSC.
Bottom line
The update from CERT-FR turns a single-vendor incident into a multi-vendor, multi-country campaign against internet-facing refrigeration controls. UK organisations running the same equipment should assume they are being scanned now. Taking these consoles off the public internet is cheap, quick and the single most effective step available.
Sources
- Cybernews: Food safety fears grow as Copeland is named as second fridge supplier hit in supermarket hacking spree
- Claroty: France Supermarket Hacks Expose Risks of Internet-Facing Refrigeration Systems
- eSecurity Planet: Hackers Target 300+ French Supermarkets: Refrigeration Attack Exposes Security Risks
- SecurityWeek: Refrigeration Controller Hack Spoils Food Across European Supermarkets
- The Register: Cyberattacks crank French supermarket refrigeration systems up to 50°C
- Industrial Cyber: UK NCSC warns of increased OT targeting as threat actors exploit internet-exposed systems and edge devices
