"This is an essential system for the proper preservation of food products," said Dominique Schelcher, CEO of Coopérative U.
Initial disruption: supermarkets, food stocks, and alarming settings
On October 11 supermarkets across France began reporting food stock disruptions after a cyber‑attack that targeted refrigeration controllers. French local media France 3 reported that an E. Leclerc supermarket in the Tarn region experienced refrigeration disruptions despite using Dixell equipment rather than Danfoss. National newspaper Le Monde described a supermarket near Bordeaux where attackers reportedly changed freezer settings from −22°C to 150°C; a technician at that site said several settings were being altered per second, suggesting automation.
CERT‑FR advisory names specific controller models (October 12)
The French national Computer Emergency Response Team (CERT‑FR) published a security advisory on October 12 that specifically named Danfoss AK‑SC and AK‑SM series as well as Dixell xweb and Copeland xweb as "affected systems." The advisory broadened the incident’s apparent footprint beyond a single vendor, indicating attack activity touched controllers from both Danfoss and Dixell Electronics (an Italian brand owned by Copeland).
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildExpert assessment: deliberate sabotage, not high sophistication
Amir Preminger, CTO of industrial security provider Claroty, told Infosecurity that refrigeration controllers are an attractive target across industries — supermarkets, cold‑storage facilities, warehouses, pharmaceutical and chemical manufacturing — because such devices are often overlooked by security teams. He said many of these devices are directly exposed to the public internet, which reduces maintenance costs through remote troubleshooting but also "lowers the barrier to entry for attackers."
Preminger assessed the operation as a deliberate attempt to cause damage but not necessarily technically sophisticated: "I don't think it's sophisticated," he said. He argued that an action such as initiating a defrost cannot be done "by mistake by typing the wrong parameter" — "Somebody needed to guide the exploit, the campaign to have that impact." He compared the apparent tactic to an incident at a food‑processing facility in Israel in 2025 where an attacker inside the facility network manipulated a refrigeration compressor and caused defrosting, while cautioning he did not claim the incidents involved the same group.
Preminger warned that patching alone is not sufficient when devices are exposed publicly. His operational advice: keep critical devices off the public internet, restrict access through corporate VPNs or APN gateways, and segment and inventory equipment. "Gate your devices, segment your devices. That's the first frontier," he said.
Why supermarket refrigeration is networked — regulation and remote maintenance
The controllers are networked for two stated reasons. In Europe, legislation requires timestamped monitoring of temperatures and alarm systems to detect abnormal rises in temperature, measures intended to strengthen food safety. Network connectivity also enables remote maintenance. Dominique Schelcher emphasized the function: "This is an essential system for the proper preservation of food products," framing why operators allow and rely on remote access despite the risks.
What this means for supermarket operators, technologists, and regulators
- Technologists and security teams: Claroty’s Preminger urged immediate steps to remove critical controllers from the public internet where practical, to restrict access via VPNs or APN gateways, and to segment networks so controller access is tightly limited.
- Supermarket operators and procurement leaders: the CERT‑FR advisory naming Danfoss AK‑SC and AK‑SM, and Dixell/Copeland xweb devices signals an urgent need to inventory deployed controller models, confirm software versions, and verify how remote access is configured for maintenance.
- Regulators and safety officials: existing European requirements for timestamped monitoring and alarms explain why controllers are networked; regulators may now face pressure to balance food‑safety monitoring rules against enforced network‑segmentation or minimum security configurations for controllers.
The incident’s immediate effect is concrete — disrupted refrigeration and strained food stocks at affected sites — and the advisory from CERT‑FR ties the problem to specific device families. Beyond that, questions remain about how many devices worldwide are internet‑exposed, which software versions are present, and who directed the campaign; as Preminger noted, exposed Danfoss devices could be found outside France, including in Israel and the US, though he did not know their software versions or vulnerability status.
The practical next step for operators named in the advisory is clear: inventory, segment, and restrict access to refrigeration controllers while investigating whether automated tooling was used to change device parameters. The broader anxiety is equally plain — when devices that preserve food are reachable from the public internet, deliberate sabotage moves from hypothetical to demonstrable.
