What happened
During the night of October 11-12, 2026, attackers manipulated refrigeration controls across French supermarkets, causing food spoilage and reported fires. CERT-FR said it knew of numerous compromises affecting Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb remote refrigeration controllers. On October 13, 2026, CERT-FR expanded its alert to include Copeland xweb and Dixell xweb alongside Danfoss AK-SM and AK-SC controllers. The update materially broadened the response beyond the Danfoss equipment initially associated with the disruption.
AP reported that about 700 of France’s 10,000 supermarkets were affected; Groupement Mousquetaires said 300 Intermarché and Netto stores, while Coopérative U said 80 stores. Reported attack effects included continuous defrost cycles, temperatures as high as 50 degrees Celsius, spoiled food and reported fires. The counts vary across reporting periods and organisations, but the evidence establishes distributed physical impact rather than an isolated store malfunction.
CERT-FR instructed operators to remove public IP exposure, verify defrost schedules, and restore access only through a secure VPN or protected network. The cited official alert published no IP addresses, domains, hashes, malware filenames or confirmed initial-access mechanism. CERT-FR also distinguished apparently clean devices from compromised equipment: suspected units require isolation, factory reset and trusted reconfiguration, while unsupported equipment remains unsafe if returned to the same public exposure. Attribution posture: CERT-FR and reporting name no responsible actor, and no public claim had been established by October 13, 2026. The cited source did not publish the specific indicators described as Initial-access mechanism and indicators.
Why this matters now
This is not primarily a confidentiality event. Remote manipulation reached the physical process that protects food, creating direct safety, fire, stock-loss and store-continuity consequences. The expansion from one vendor family to Copeland and Dixell means a response limited to Danfoss inventory is incomplete. Retailers, cold-chain operators, logistics facilities, laboratories and other organisations using remotely managed refrigeration should test exposure by controller model and management architecture, not by corporate network boundary alone.
The incident also exposes an accountability gap between asset owners and refrigeration specialists. Stores may buy refrigeration as a managed service while the service provider controls internet connectivity, firmware and privileged access. That operating model can leave the enterprise responsible for business and safety impact without decision-grade visibility into public exposure or product lifecycle. Executives therefore need named ownership for isolation, evidence preservation, food-safety decisions, insurance conditions and the replacement of end-of-life equipment.
The decision for security leaders
Assign the response jointly to the CISO, facilities or OT leadership, food-safety owners and procurement. Cyber teams can identify exposure and preserve evidence, but only operational owners can validate safe temperatures and continuity. Do not let a refrigeration contractor close the incident solely by confirming that remote access works again; require the enterprise to approve network placement, firmware state, settings and safe service restoration.
Separate immediate containment from lifecycle resolution. Public exposure must be removed now, but a factory reset does not make unsupported equipment defensible. Establish a time-bound exception for any end-of-life controller that cannot be replaced immediately, document compensating isolation and local operating procedures, and confirm whether insurance or service contracts impose evidence-preservation requirements before connectivity is changed.
Evidence of closure
- External testing shows no listed controller management interface reachable on a public IP address.
- Approved configuration records confirm validated defrost schedules, strict security mode and changed default credentials.
- Rebuilt units pass documented temperature, alarm and fail-safe validation from a trusted baseline.
- Provider assurance identifies supported firmware and approved replacement dates for every end-of-life controller.
The Security.io assessment
The decisive risk is the combination of operational consequence and weak ownership across a managed-service boundary. The official alert does not establish which vulnerability or credential path was used, so patching one historical CVE cannot prove safety. Closure requires evidence that the controller is no longer publicly reachable, its configuration is trusted, physical operation is validated and the refrigeration provider cannot silently recreate the old exposure.
Reuters reported at least 4,500 Danfoss interfaces still visible through Shodan on October 13, 2026, without establishing how many ran vulnerable software. That figure is exposure telemetry, not a victim count, but it indicates substantial opportunity for continued scanning and repeat access. Enterprises should assume that rapid restoration to an unchanged network design preserves the original risk until external exposure testing and supplier assurance prove otherwise.
Questions for the morning meeting
- Who owns risk acceptance for unsupported refrigeration controllers that remain operational?
- Can each site maintain safe operations when supplier remote access is isolated?
- Which refrigeration providers retain privileged access, and what evidence governs that access?