Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers

What it is

An ongoing attack on internet-exposed commercial refrigeration controllers. It disrupted refrigeration at about 700 of France's roughly 10,000 supermarkets (Finance Minister figure; earlier reports said 300-350). CERT-FR first warned on October 12 about Danfoss AK-SM and AK-SC series controllers. On October 13 it extended the alert to Copeland XWEB and Dixell XWEB systems. Copeland first declined to confirm, then acknowledged a vulnerability and said it is working with affected customers.

How it works

The access vector is unknown. The CERT-FR alert ties the compromises to no specific vulnerability, and neither Danfoss nor French authorities have linked the attack to the flaws Claroty disclosed this summer (flaws in the Danfoss AK-SM 800A, and 23 vulnerabilities in Copeland XWEB Pro, which Copeland patched in a firmware update). Per Le Monde, the attackers lengthened defrost cycles from one hour to as many as eight, which delayed alarms. Intermarché refrigeration units ran at 50 °C for six hours. Prosecutors reported fires as well as food losses.

Preconditions / Affected

• Danfoss: mostly older AK-SM 800 (support ended May 2021) and AK-SC 355 (discontinued 2016). Both are end of life and unpatched. Some current AK-SM 800A units running outdated firmware were also hit.
• Copeland XWEB and Dixell XWEB: affected, with no version detail given.
• Exposure: Censys counted nearly 3,000 internet-exposed Danfoss StoreView panels on October 11, more than 1,800 of them in France.
• Sekoia reported stores also affected in Spain, Portugal, Poland, Germany and Belgium, with no details.

What to do

• Take the controllers off the internet.
• Restore remote access only through a secure VPN or protected network.
• Treat IP filtering as a temporary emergency measure only.
• For compromised EOL devices, don't rely on a factory reset. The device stays vulnerable and will likely be compromised again if it stays exposed. The page offers no alternative beyond keeping them off the internet.
• Patching is not a substitute for isolation here. Censys saw patched and unpatched versions disappear at about the same rate, so operators are disconnecting rather than updating. Outside France the exposed count barely changed (France: 1,800+ to 537 by October 14), so those exposures remain.

Caveats

• The initial access vector is unconfirmed. Whether the Claroty-disclosed flaws are involved is unknown, so the Copeland firmware patch is not shown to prevent this attack.
• No group has claimed responsibility and no ransom has been demanded. Investigators are reportedly puzzled.
• The Sekoia claim of stores in other countries is unsubstantiated. The Dutch NCSC said the Ahold Delhaize incident is not connected.
• The page gives no indicators of compromise or detection guidance.