Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers

In October 2026, a widespread cyberattack targeted refrigeration controllers in French supermarkets, impacting roughly 700 stores. Initially, Danfoss AK-SM and AK-SC series controllers were compromised, later expanding to Copeland XWEB and Dixell XWEB systems. The attack involved lengthening defrost cycles from one hour to up to eight hours, delaying alarms and causing food spoilage and fires. Many affected devices are end-of-life models no longer supported or patched by vendors, while some current models with outdated firmware were also impacted. Copeland had previously patched 23 vulnerabilities in its XWEB Pro controller, but it is unclear if these were exploited. The French national cybersecurity agency ANSSI and CERT-FR have advised operators to remove affected controllers from direct internet exposure and use secure VPNs for remote access. The attack has prompted investigations but no attribution or ransom demands have been identified.

The attack caused significant operational disruption in French supermarkets, including food spoilage due to refrigeration failures and fires. Approximately 700 stores were affected, with some chains discarding all food in impacted locations. Financial losses include at least €270,000 reported by two supermarkets in Alsace. The attack also raised concerns about liability between supermarket chains and equipment suppliers. The disruption affected major supermarket chains such as Carrefour, Coopérative U, E.Leclerc, Intermarché, and Monoprix. The incident highlights risks associated with using unsupported or outdated industrial control devices exposed to the internet.

Operators of affected refrigeration controllers are urged to disconnect these devices from direct internet exposure immediately. Remote access should be restored only through secure VPNs or protected networks. Filtering connections by IP address is recommended only as a temporary emergency measure. For end-of-life devices, factory resets are insufficient as vulnerabilities remain; such devices should be replaced or isolated. Vendors like Copeland are working with customers to mitigate risks. No official patch or fix has been confirmed for the specific attack vector used. Operators should follow guidance from ANSSI and CERT-FR and monitor vendor advisories for updates.