French Supermarkets Hit by Refrigeration Controller Compromises
ANSSI warns that Copeland and Dixell systems were targeted alongside Danfoss units in attacks disrupting hundreds of stores across France.
Key points
- Roughly 700 French supermarkets experienced refrigeration disruptions due to compromised controllers.
- ANSSI identified impacts on Danfoss, Copeland XWEB, and Dixell XWEB systems.
- Affected devices include end-of-life models that no longer receive security patches.
Cyberattacks targeting industrial refrigeration controllers disrupted operations at hundreds of French supermarkets, according to France’s national cybersecurity agency ANSSI. The incident involved connected temperature management hardware used by major retail chains. SecurityWeek reported that no threat group has claimed responsibility for the widespread compromises affecting critical infrastructure components.
Root cause
ANSSI’s CERT-FR issued initial warnings on October 12 regarding compromises of Danfoss AK-SM and AK-SC series controllers. The agency expanded its alert a day later to include Copeland XWEB and Dixell XWEB systems. Claroty previously disclosed vulnerabilities in these devices this summer, but authorities have not linked the current attacks to those specific flaws.
Attack path
It remains unclear how attackers initially gained access to the refrigeration networks. CERT-FR did not specify the exploitation method in its alert. Danfoss and French authorities have not tied the compromises to the vulnerabilities Claroty disclosed earlier this year. The lack of attribution suggests the entry vector may differ from known public exploits.
Affected versions
- Danfoss AK-SM 800 and AK-SC 355 systems, which are end-of-life.
- Danfoss AK-SM 800A controllers running outdated firmware.
- Copeland XWEB systems.
- Dixell XWEB systems.
Mitigation
- Remove affected controllers from direct internet exposure immediately.
- Restore remote access only through secure virtual private networks.
- Use IP filtering only as a temporary emergency measure.
- Perform factory resets on compromised devices, though this may not suffice for end-of-life hardware.
Detection notes
Security teams usually monitor for anomalous outbound traffic from industrial control devices. Check whether refrigeration controllers are communicating with unknown external IP addresses or ports. Look for unexpected configuration changes or firmware version mismatches in network logs. Verify that remote management sessions originate from authorized administrative subnets. Isolate any device exhibiting suspicious behavior to prevent lateral movement within the operational technology network.
What to do and how to stay safe: Danfoss
- Audit all connected refrigeration controllers for unauthorized firmware versions.
- Ensure industrial control systems are segmented from corporate networks.
- Monitor logs for unusual data exfiltration from operational technology devices.
- Verify that remote access to critical infrastructure uses multi-factor authentication.
Step-by-step guide: Phishing Defenses: Answers to 10 Critical Questions
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which supermarket chains were affected?
Carrefour, Coopérative U, E.Leclerc, Intermarché, and Monoprix confirmed impacts.
How many stores were impacted?
Finance Minister Roland Lescure stated roughly 700 supermarkets were affected.
Is there a permanent fix for end-of-life devices?
No, as these devices are discontinued, factory resets may not prevent re-compromise.
