{ "site": "https://pwn.watch", "generatedAt": "2026-10-23T03:01:01.167Z", "tag": { "id": "dixell", "label": "Dixell", "isStack": false, "url": "https://pwn.watch/t/dixell", "feed": "https://pwn.watch/t/dixell/feed.xml" }, "counts": { "incidents": 1, "live": 1, "notFullyPatched": 1, "patched": 0 }, "incidents": [ { "slug": "french-supermarket-refrigeration-controller-attacks", "title": "Hackers hijack refrigeration controllers at about 700 French supermarkets (Danfoss, Copeland and Dixell XWEB)", "url": "https://pwn.watch/i/french-supermarket-refrigeration-controller-attacks", "json": "https://pwn.watch/i/french-supermarket-refrigeration-controller-attacks.json", "status": "live", "severity": "critical", "patchStatus": "partial", "product": "Danfoss AK-SM / AK-SC refrigeration controllers, Copeland and Dixell xweb controllers", "tags": [ "danfoss", "copeland", "dixell", "ics-ot", "refrigeration", "france", "cert-fr", "end-of-life", "sabotage" ], "cveIds": [], "affectedVersions": [ "Danfoss AK-SM 800 (end of life since 2021, no fixes)", "Danfoss AK-SC 355 (phased out 2016, no fixes)", "Danfoss AK-SM 800A on outdated firmware", "Copeland / Dixell XWEB EVO (end of life, no security patches)" ], "fixedVersions": [ "No fix for end-of-life units: remove internet exposure and replace them", "Danfoss AK-SM 800A: update to current firmware, security level Strict, change default passwords (CERT-FR)" ], "startedAt": "2026-10-11", "closedAt": null, "updatedAt": "2026-10-23T03:00:20Z", "summary": "Overnight on Oct 11 to 12, attackers took remote control of internet-exposed refrigeration controllers at hundreds of French supermarkets (Intermarché and Netto, Coopérative U, E. Leclerc and others), forcing fridges and freezers into continuous defrost with setpoints around 50°C, spoiling fresh and frozen stock and reportedly causing small fires. CERT-FR names Danfoss AK-SM and AK-SC series plus Copeland and Dixell xweb controllers, says campaigns are probably still ongoing, and tells operators to take every controller off the public internet. Most affected Danfoss units are end-of-life models (AK-SM 800, AK-SC 355) that get no fixes; the entry vector and attacker are still unconfirmed.", "xPost": { "id": "2113376850034720917", "postedAt": "2026-10-22T21:08:00.643Z", "url": "https://x.com/pwnwatch_app/status/2113376850034720917" } } ], "posts": [ { "authorName": "Dark Web Intelligence", "handle": "DailyDarkWeb", "avatarUrl": "https://pbs.twimg.com/profile_images/1507666522008915969/T-CQnTJy_bigger.jpg", "text": "🇫🇷 🚨 UPDATE: FRANCE REFRIGERATION ATTACKS EXPAND TO COPELAND AND DIXELL CONTROLLERS\n\nFollow-up to our Oct 12 coverage of the Danfoss supermarket refrigeration attacks. On Oct 13, 2026, CERT-FR revised alert CERTFR-2026-ALE-012, adding Copeland xweb and Dixell xweb controllers to https://t.co/rqk69Vq9an https://t.co/GzehBfwh39", "date": "2026-10-13T22:32:29.000Z", "url": "https://x.com/DailyDarkWeb/status/2110136618724319548", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HUi2EU_a0AA1Bht.jpg" } ], "incident": "french-supermarket-refrigeration-controller-attacks" }, { "authorName": "Dominique Schelcher", "handle": "schelcher", "avatarUrl": "https://pbs.twimg.com/profile_images/1878069293562118144/xp2a7g0C_bigger.jpg", "text": "Je confirme qu’une cyberattaque touche depuis cette nuit les installations de production de froid de plusieurs magasins de notre réseau @CooperativeU.\nNos équipes sont pleinement mobilisées, en lien avec les frigoristes, pour rétablir la situation au plus vite. Une enquête devra permettre de faire toute la lumière sur cette attaque.\nS’attaquer à des équipements essentiels à la conservation des produits frais et à l’approvisionnement alimentaire des Français est d’une extrême gravité et est inédit. C’est inacceptable.", "date": "2026-10-12T08:40:47.000Z", "url": "https://x.com/schelcher/status/2109564928881308012", "media": [], "incident": "french-supermarket-refrigeration-controller-attacks" } ], "changes": [ { "incident": "french-supermarket-refrigeration-controller-attacks", "incidentTitle": "Hackers hijack refrigeration controllers at about 700 French supermarkets (Danfoss, Copeland and Dixell XWEB)", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Dark Reading reports a little over 700 stores were hit in one night; a Sekoia analyst told Reuters Spain, Portugal, Poland, Germany and Belgium were also affected, and Les Mousquetaires (Intermarché, Netto) said the attack came through a refrigeration service provider.", "body": null, "sourceUrl": "https://www.darkreading.com/ics-ot-security/eu-grocers-unpatched-fridge-firmware-french", "url": "https://pwn.watch/i/french-supermarket-refrigeration-controller-attacks" }, { "incident": "french-supermarket-refrigeration-controller-attacks", "incidentTitle": "Hackers hijack refrigeration controllers at about 700 French supermarkets (Danfoss, Copeland and Dixell XWEB)", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-16", "title": "CERT-FR publishes a third version with separate steps for compromised and uncompromised units: remove internet exposure, check defrost ranges, restore access only via VPN, and reset and reconfigure compromised Danfoss units.", "body": null, "sourceUrl": "https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/", "url": "https://pwn.watch/i/french-supermarket-refrigeration-controller-attacks" }, { "incident": "french-supermarket-refrigeration-controller-attacks", "incidentTitle": "Hackers hijack refrigeration controllers at about 700 French supermarkets (Danfoss, Copeland and Dixell XWEB)", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-13", "title": "CERT-FR revises the alert to add Copeland xweb and Dixell xweb controllers, warns campaigns are probably still ongoing, and says a factory reset alone leaves end-of-life units vulnerable to recompromise.", "body": null, "sourceUrl": "https://www.csoonline.com/article/4235107/unplug-your-smart-fridges-french-supermarkets-warned-after-cyberattack.html", "url": "https://pwn.watch/i/french-supermarket-refrigeration-controller-attacks" }, { "incident": "french-supermarket-refrigeration-controller-attacks", "incidentTitle": "Hackers hijack refrigeration controllers at about 700 French supermarkets (Danfoss, Copeland and Dixell XWEB)", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-12", "title": "Coopérative U CEO Dominique Schelcher confirms on X that a cyberattack hit the refrigeration installations of several stores overnight, calling it unprecedented and unacceptable.", "body": null, "sourceUrl": "https://x.com/schelcher/status/2109564928881308012", "url": "https://pwn.watch/i/french-supermarket-refrigeration-controller-attacks" }, { "incident": "french-supermarket-refrigeration-controller-attacks", "incidentTitle": "Hackers hijack refrigeration controllers at about 700 French supermarkets (Danfoss, Copeland and Dixell XWEB)", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-12", "title": "CERT-FR publishes alert CERTFR-2026-ALE-012 on numerous compromises of Danfoss AK-SM and AK-SC refrigeration controllers. Danfoss says affected units ran outdated firmware and urges migrating legacy systems.", "body": null, "sourceUrl": "https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/", "url": "https://pwn.watch/i/french-supermarket-refrigeration-controller-attacks" }, { "incident": "french-supermarket-refrigeration-controller-attacks", "incidentTitle": "Hackers hijack refrigeration controllers at about 700 French supermarkets (Danfoss, Copeland and Dixell XWEB)", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-11/12", "title": "Overnight, attackers remotely hijack supermarket refrigeration controllers across France, forcing continuous defrost with setpoints around 50°C; Intermarché, Coopérative U and E. Leclerc confirm the attack.", "body": null, "sourceUrl": "https://www.theguardian.com/world/2026/oct/12/cyber-attack-defrosts-refrigerators-france-supermarket-chains-intermarche-cooperative-u", "url": "https://pwn.watch/i/french-supermarket-refrigeration-controller-attacks" } ] }