Forescout: 6,017 exposed refrigeration controllers in 99 countries after attacks on 700+ French supermarkets
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 24/10/2026 00:06; os links antigos trazem para cá.
Forescout's Vedere Labs found 12,976 internet-exposed service observations across ten refrigeration-management product groups, tied to 6,017 distinct public IP addresses in 99 countries and territories. The research follows October 2026 attacks that disrupted refrigeration at French supermarkets, causing temperature fluctuations and spoiled stock. The earlier report speaks of hundreds of stores (itsecurityguru.org). The later report says CERT-FR confirmed more than 700 stores, involving Danfoss AK-SM and AK-SC, Copeland and Dixell XWEB systems (industrialcyber.co). The figures count exposed services, not confirmed compromised devices. Initial access, exploited vulnerabilities, attacker infrastructure, persistence and the identity of the French attackers remain unconfirmed in both sources. Since January 2026 Forescout has also tracked more than 20 claimed hacktivist attacks on refrigeration systems, with pro-Russian groups Z-Pentest Alliance and NoName057(16) among the most active.
Entenda a falha
A vulnerabilidade
The story names CVE-2025-41451 and CVE-2025-41452, which industrialcyber.co says affect Danfoss AK-SM 800A / StoreView firmware older than 4.3.1. The articles do not describe the flaw type, the component, what an attacker needs or what they gain. Forescout found 3,762 StoreView observations (80% of 4,697) on that older firmware, but firmware versions are often not visible, so it could not confirm which exposed services are actually vulnerable. The French attacks (more than 700 stores, per CERT-FR; Danfoss AK-SM/AK-SC, Copeland and Dixell XWEB) have no confirmed exploited vulnerability. Weak or missing authentication is the other exposure, and the AK-SM 800 targeted in France is end-of-life and cannot be patched.
Como funciona
The articles do not explain how the two CVEs work internally. They describe the attack pattern on exposed systems: an attacker reaches a refrigeration management interface (HMI or web supervisor) directly from the internet, gets in through weak or missing credentials or possibly a known flaw, and then uses legitimate supervisory functions to change temperature setpoints and defrost schedules. Rapid successive configuration changes suggest automation. No destructive malware is needed, so the changes can look like routine maintenance.
Por que é vulnerável
For the two CVEs, the articles give no root cause. The broader exposure comes from management interfaces published directly on the internet, authentication that is sometimes missing or weak (only 287 of 513 pCOWeb services returned HTTP 401), and end-of-life models that cannot be patched. industrialcyber.co notes that manufacturer deployment documentation supported remote connectivity. Updating to firmware 4.3.1 or later is the implied fix, but the articles do not say what it changes.
Como foi descoberta
The exposure findings come from Forescout's Vedere Labs, which analyzed internet-exposed asset data (12,976 service observations, 6,017 public IPs, 99 countries) and published them in a blog post on Thursday, October 22, 2026. The articles do not say who found CVE-2025-41451 and CVE-2025-41452 or how they were reported; itsecurityguru.org calls them previously disclosed flaws. French authorities and incident responders investigated the supermarket incidents, and CERT-FR confirmed the affected product families. Forescout has also tracked more than 20 claimed hacktivist attacks since January 2026.
Explicação gerada por IA a partir da matéria e dos artigos, em 24/10/2026 00:21.
Detalhes técnicos
- Observations by product: Copeland/Dixell XWEB 7,075; Danfoss StoreView 4,697; Copeland Site Supervisor 551; Carel pCOWeb 513; 140 across six other product groups (itsecurityguru.org).
- The attacks abuse legitimate supervisory functions to change temperature settings and defrost cycles, so no destructive malware is needed. This makes them hard to tell apart from routine maintenance (itsecurityguru.org). Rapid successive configuration changes suggest automation (industrialcyber.co).
- Weak or missing authentication: only 287 of 513 pCOWeb services returned HTTP 401. Credentials may also be weak or bought from other attackers (industrialcyber.co).
- Known vulnerabilities: 3,762 StoreView observations (80%) run firmware older than 4.3.1. These are potentially affected by CVE-2025-41451 and CVE-2025-41452 (CVE IDs given by industrialcyber.co; the earlier article mentioned two flaws without naming them, itsecurityguru.org). Firmware versions are often not visible, so applicability per service could not be confirmed (industrialcyber.co).
- Some models, such as the Danfoss AK-SM 800 targeted in France, are end-of-life and cannot be patched (industrialcyber.co).
- Recurring problems: publicly accessible management interfaces, outdated firmware, weak authentication and poor visibility of contractor-installed equipment (itsecurityguru.org).
- Hacktivist targets are mainly fruit storage, wineries, supermarkets, food processing and agricultural businesses in Europe, including Spain and Italy, reached through exposed HMIs. On April 26, Z-Pentest claimed 10 attacks in a single day (industrialcyber.co).
- A Danfoss technical bulletin attributes 2022 hacktivist attacks to 16 Russian supermarkets and 40 stores in Israel (itsecurityguru.org).
- Hospitals, pharmaceuticals, manufacturing and logistics also rely on similar refrigeration and temperature control and are at risk.
Remediação
- Remove direct public internet access to refrigeration management interfaces and use secure remote-access gateways.
- Patch supported devices and replace unsupported or end-of-life equipment.
- Eliminate shared or stale contractor credentials. Require named individual identities, MFA, least privilege and session logging.
- Inventory the full control path, including public IPs, port forwarding, NAT, VPNs and supervisory platforms.
- Monitor and correlate remote sessions with changes to setpoints, defrost schedules, alarms and users, using IoT/OT-aware network monitoring.
Relatos divergentes
- Scale of the French attacks: "hundreds of French supermarkets" (itsecurityguru.org, 22 Oct) versus more than 700 stores confirmed by CERT-FR (industrialcyber.co, 23 Oct). The later report is more specific and cites a government source.
- CVE details: the earlier article did not name the flaws; the later one identifies CVE-2025-41451 and CVE-2025-41452 (industrialcyber.co), and caveats that firmware applicability could not be confirmed.
Linha do tempo
-
Forescout: 6,017 internet-exposed refrigeration controllers in 99 countries; 700+ French supermarkets hit by temperature manipulation
ler a análise desta fonte ocultar
Forescout's Vedere Labs identified 12,976 internet-exposed service observations tied to refrigeration management systems across 6,017 public IP addresses in 99 countries and territories. In October 2026, CERT-FR confirmed that incidents at more than 700 French supermarkets involved Danfoss AK-SM and AK-SC, Copeland and Dixell XWEB systems. Attackers changed temperature and defrost controls, causing food losses. Initial access, exploited vulnerabilities, attacker infrastructure, persistence and attribution remain unconfirmed. Since January 2026, Forescout has also tracked more than 20 claimed hacktivist attacks on refrigeration systems, with pro-Russian groups Z-Pentest Alliance and NoName057(16) among the most active.
Technical Details
- The exposed services span 10 product groups, including Copeland/Dixell XWEB, Danfoss StoreView, Copeland Site Supervisor and Carel pCOWeb.
- The attacks abuse legitimate supervisory functions, so no destructive malware is needed. Rapid successive configuration changes suggest automation.
- Attack path 1, weak or missing authentication: only 287 of 513 pCOWeb services returned HTTP 401. Credentials may also be weak or bought from other attackers.
- Attack path 2, known vulnerabilities: some models, such as the Danfoss AK-SM 800 targeted in France, are end-of-life and cannot be patched. 3,762 StoreView observations (80% of Danfoss AK-SM 800A) run firmware older than 4.3.1, which is affected by CVE-2025-41451 and CVE-2025-41452. Firmware versions are often not visible, so applicability per service could not be confirmed.
- Hacktivist targets were mainly fruit storage, wineries, supermarkets and food processing in Spain, Italy and elsewhere in Europe, through exposed HMIs. On April 26, Z-Pentest claimed 10 attacks in a single day.
- Hospitals and agricultural facilities that use similar cooling equipment are also at risk.
Remediation
- Remove direct public internet access to refrigeration management interfaces and use secure remote-access gateways.
- Patch supported devices and replace unsupported ones.
- Eliminate shared or stale contractor credentials. Require named identities, MFA, least privilege and session logging.
- Inventory the full control path, including public IPs, port forwarding, NAT, VPNs and supervisory platforms.
- Monitor and correlate remote sessions with changes to setpoints, defrost schedules, alarms and users, using IoT/OT-aware network monitoring.
-
Forescout warns of 6,017 exposed refrigeration control IPs after October 2026 attacks on French supermarkets
ler a análise desta fonte ocultar
Forescout's Vedere Labs published research on internet-exposed refrigeration control systems after reported October 2026 cyberattacks that disrupted refrigeration at hundreds of French supermarkets, causing temperature fluctuations and spoiled stock. The researchers observed 12,976 exposed service observations across ten product groups, tied to 6,017 distinct public IP addresses in 99 countries and territories. These figures count exposed services, not confirmed compromised devices. Forescout has tracked more than 20 claimed attacks on refrigeration systems since January 2026, with pro-Russian hacktivist groups Z-Pentest Alliance and NoName057(16) among the most active. The initial access method and the identity of those behind the French attacks have not been confirmed.
Technical Details
- Observations by product: Copeland/Dixell XWEB 7,075; Danfoss StoreView 4,697; Copeland Site Supervisor 551; Carel pCOWeb 513; 140 across six other product groups.
- 3,762 Danfoss StoreView observations (80%) ran firmware older than 4.3.1, making them potentially vulnerable to two previously disclosed flaws (CVE IDs not given in the article).
- Recurring problems: publicly accessible management interfaces, outdated firmware, weak authentication and poor visibility of contractor-installed equipment.
- Attackers with access can change temperature settings, interfere with defrost cycles or disrupt equipment using legitimate management functions, without malware. This makes the activity hard to tell apart from routine maintenance.
- A Danfoss technical bulletin attributes 2022 hacktivist attacks to 16 Russian supermarkets and 40 stores in Israel.
- Targets of the 2026 claimed attacks include supermarkets, wineries, fruit storage facilities and agricultural businesses across Europe.
- Refrigeration and temperature control are also used in healthcare, pharmaceuticals, manufacturing and logistics.
Remediation
- Remove publicly accessible management interfaces.
- Replace unsupported equipment and apply available security updates.
- Provide secure remote access for maintenance contractors.
- Enforce multifactor authentication and individual user accounts.
- Continuously monitor for suspicious changes to temperature settings, defrost schedules and alarms.
- Maintain visibility of connected devices, who can access them and what changes they can make.