[critical] Hackers hijack refrigeration controllers at about 700 French supermarkets (Danfoss, Copeland and Dixell XWEB)

Fri, 23 Oct 2026 01:55:38 GMT

Overnight on Oct 11 to 12, attackers took remote control of internet-exposed refrigeration controllers at hundreds of French supermarkets (Intermarché and Netto, Coopérative U, E. Leclerc and others), forcing fridges and freezers into continuous defrost with setpoints around 50°C, spoiling fresh and frozen stock and reportedly causing small fires. CERT-FR names Danfoss AK-SM and AK-SC series plus Copeland and Dixell xweb controllers, says campaigns are probably still ongoing, and tells operators to take every controller off the public internet. Most affected Danfoss units are end-of-life models (AK-SM 800, AK-SC 355) that get no fixes; the entry vector and attacker are still unconfirmed.

Status: live · Patch: partial · Fixed in: No fix for end-of-life units: remove internet exposure and replace them, Danfoss AK-SM 800A: update to current firmware, security level Strict, change default passwords (CERT-FR)

Latest updates:

2026-10-22: Dark Reading reports a little over 700 stores were hit in one night; a Sekoia analyst told Reuters Spain, Portugal, Poland, Germany and Belgium were also affected, and Les Mousquetaires (Intermarché, Netto) said the attack came through a refrigeration service provider. (source)
2026-10-16: CERT-FR publishes a third version with separate steps for compromised and uncompromised units: remove internet exposure, check defrost ranges, restore access only via VPN, and reset and reconfigure compromised Danfoss units. (source)
2026-10-13: CERT-FR revises the alert to add Copeland xweb and Dixell xweb controllers, warns campaigns are probably still ongoing, and says a factory reset alone leaves end-of-life units vulnerable to recompromise. (source)

pwn.watch: End of life incident updates

[critical] Hackers hijack refrigeration controllers at about 700 French supermarkets (Danfoss, Copeland and Dixell XWEB)