ANSSI extends French supermarket refrigeration alert to Copeland and Dixell XWEB controllers
France's cyber agency ANSSI says the attack that hit about 700 supermarkets also reached Copeland and Dixell XWEB refrigeration controllers. Danfoss says most of its affected units are end-of-life and unpatched.
The Watch · Security desk
Censys counted 537 internet-exposed Danfoss StoreView panels in France on October 14, against more than 1,800 in France on October 11. Outside France, no more than about 1,200 panels were exposed, a number that barely changed by October 14.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Exposed StoreView panels in France, October 14 | 537 panels | 17 | |
| France, October 11 | 1,800 panels, over | 17 | |
| Exposed outside France, no more than | 1,200 panels, about | barely changed by October 14 | 20 |
What happened
- Copeland first declined to confirm the agency's findings, then acknowledged a vulnerability.
- Danfoss stopped supporting the AK-SM 800 in May 2021 and discontinued the AK-SC 355 in 2016.
- The Paris prosecutor's cybercrime unit has opened an investigation and said the attack caused fires as well as food losses.
- Censys counted more than 1,800 exposed Danfoss StoreView panels in France on October 11 and 537 on October 14.
Why it matters
- Who's exposed exposure Outside France the exposed StoreView count barely moved while the French count fell, leaving at most about 1,200 panels still reachable on October 14.
- What it limits constraint Remote access has to move behind a secure VPN or protected network. IP filtering is a stopgap for the emergency only.
- What doesn't add up contradiction The end-of-life explanation covers most Danfoss units but not the current AK-SM 800A controllers or the XWEB systems, so patch status alone will not sort safe units from exposed ones.
- Who has to decide decision Operators of vendor-managed controllers must settle who disconnects them and who files complaints; Les Mousquetaires has already said that falls to Danfoss, according to Bloomberg.
For the end-of-life Danfoss units there is no update to apply [6]. CERT-FR says a factory reset leaves a compromised one vulnerable, and likely to be compromised again if it stays exposed [12].
The legacy-hardware reading stops short in two places. Some current AK-SM 800A controllers running outdated firmware were also affected [8], and those can be patched. The XWEB units joined the alert on October 13, a day after the first warning on October 12 [2]. Copeland said: "We are currently working with impacted customers to mitigate the risk" [5]. The sources do not say which XWEB models or firmware versions were hit.
Patching is not shown to be a fix, because nobody has named the entry point. The CERT-FR alert names no vulnerability behind the compromises, and Danfoss and French authorities have not connected the attack to the flaws Claroty made public this summer [9]. Those were flaws in the AK-SM 800A and 23 vulnerabilities in Copeland's XWEB Pro, which Copeland patched in a firmware update [10]. In our view, a patched controller with a public address should be treated as exposed until a vector is identified.
Operators appear to be acting on that logic. Censys noted that patched and unpatched versions disappeared from the internet at roughly the same rate, suggesting operators are disconnecting controllers rather than updating them [18].
The damage came from the controllers' own settings. The attackers stretched defrost cycles from one hour to up to eight, Le Monde reported [13]. Alarms were delayed. At Intermarché, refrigeration units ran at 50 degrees Celsius for six hours and all the food was discarded, according to owner Les Mousquetaires [15]. Two supermarkets in Alsace reported combined losses of €270,000 [16]. The 700 stores are about 7 percent of France's roughly 10,000 supermarkets [21].
A source familiar with the investigation told Reuters that no one has claimed the attack and no ransom has been demanded [22]. Félix Aimé of Sekoia said stores in Spain, Portugal, Poland, Germany and Belgium had been hit too, but gave Reuters no details [23].
What to watch
- Whether CERT-FR or Copeland name the XWEB models and firmware versions hit, and whether anyone identifies the flaw used for entry.
- Whether Censys counts of exposed StoreView panels outside France start falling the way the French count did.
- Whether authorities in Spain, Portugal, Poland, Germany or Belgium confirm Sekoia's report of affected stores, and whether anyone claims the attack or makes a ransom demand.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap−10
- Incentives45
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
ANSSI said the cyberattack that disrupted refrigeration at hundreds of French supermarkets also affected equipment from Copeland and its Dixell brand.
- [2]
CERT-FR first warned on October 12 of numerous compromises involving Danfoss AK-SM and AK-SC series refrigeration controllers; a day later it updated the alert to include Copeland XWEB and Dixell XWEB systems.
- [3]
About 700 of France's roughly 10,000 supermarkets were affected, Finance Minister Roland Lescure told lawmakers on Tuesday; earlier reports had put the number at 300-350.
- [4]
Copeland initially declined to confirm the agency's findings but has since acknowledged a vulnerability.
- [5]
Copeland said: "We are currently working with impacted customers to mitigate the risk."
- [6]
Danfoss said most of the affected devices are older AK-SM 800 and AK-SC 355 systems, which have reached end of life and are no longer patched.
- [7]
Danfoss stopped supporting the AK-SM 800 in May 2021, and the AK-SC 355 was discontinued in 2016.
- [8]
Some current AK-SM 800A controllers that were running outdated firmware were also affected.
- [9]
It is still unclear how the attackers gained access. The CERT-FR alert does not link the compromises to any specific vulnerability, and neither Danfoss nor French authorities have tied the attack to the flaws Claroty disclosed.
- [10]
This summer, Claroty detailed flaws in Danfoss's AK-SM 800A along with 23 vulnerabilities in Copeland's XWEB Pro controller; Copeland patched them in a firmware update.
- [11]
CERT-FR urged operators of the affected controllers to take them off the internet and restore remote access only through a secure VPN or protected network; filtering connections by IP address is acceptable only as a temporary emergency measure.
- [12]
For compromised end-of-life devices, a factory reset alone is not enough, as the device will remain vulnerable and is likely to be compromised again if it stays exposed.
- [13]
According to Le Monde, the attackers lengthened defrost cycles from one hour to as many as eight, which delayed alarms.
- [14]
The Paris prosecutor's office, whose cybercrime unit has opened an investigation, said the attack caused fires in addition to food losses.
- [15]
At Intermarché, about 150 stores were affected, according to owner Les Mousquetaires; refrigeration units there ran at 50 degrees Celsius for six hours and all the food was discarded.
- [16]
Two supermarkets in Alsace reported combined losses of €270,000.
- [17]
Censys counted nearly 3,000 internet-exposed Danfoss StoreView control panels on October 11, more than 1,800 of them in France. By October 14 the French count had dropped to 537, while the number elsewhere barely changed.
- [18]
Patched and unpatched versions disappeared at roughly the same rate, suggesting that operators are disconnecting the controllers rather than updating them, Censys noted.
- [19]
Les Mousquetaires said the refrigeration systems were managed by Danfoss and that it is therefore up to the supplier to file a complaint with the authorities, Bloomberg reported.
- [20]
No more than about 1,200 Danfoss StoreView panels were exposed outside France, and that number barely changed by October 14.
- [21]
The 700 affected stores are about 7 percent of France's roughly 10,000 supermarkets.
- [22]
Investigators are reportedly puzzled by the lack of either a claim of responsibility or a ransom demand, Reuters reported, citing a source familiar with the probe.
- [23]
Sekoia's Félix Aimé told Reuters that stores in Spain, Portugal, Poland, Germany and Belgium were also affected, but did not provide details.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- securityweek.comSupermarket Refrigeration Attack Widens to Copeland, Dixell Controllers
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.