/
← Voltar ao feed
critical retail food and agriculture food retail food and beverage

Coordinated attack on Danfoss and Copeland/Dixell refrigeration controllers hits up to ~700 French supermarkets, spoiling stock and causing fires

3 fonte(s) · 3 atualização(ões) · publicado 13/10/2026 07:31 · coletado há 2 dias

Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 23/10/2026 00:09; os links antigos trazem para cá.

Fontes: infosecurity-magazine.com ↗ itsecurityguru.org ↗ theregister.com ↗

A coordinated attack on supermarket refrigeration controllers began on the night of 11-12 October 2026 and hit hundreds of stores in France. Attackers remotely forced units into continuous defrost cycles, with temperatures reaching 50°C (122°F), spoiling food and causing fires, according to Paris prosecutors (itsecurityguru.org). The first reports named only Danfoss equipment (itsecurityguru.org). Later reporting shows the campaign also hit Dixell Electronics and Copeland devices (infosecurity-magazine.com, theregister.com), and the most recent count is nearly 700 stores (theregister.com). ANSSI and CERT-FR issued warnings, and CERT-FR's advisory of 12 October named Danfoss AK-SC and AK-SM, Dixell xweb and Copeland xweb (infosecurity-magazine.com). No group has claimed responsibility, no attribution has been made, and there is no evidence of a ransom demand or data theft. The initial access method is still unconfirmed. The Paris prosecutor's cybercrime unit has opened an investigation, and ANSSI is coordinating with European counterparts (itsecurityguru.org).

Entenda a falha

A vulnerabilidade

No CVE is tied to this campaign, and the exact flaw that was exploited is unconfirmed. The attack hit Danfoss AK-SM 800A/8xxA and AK-SC controllers, plus Copeland XWEB/XWEB Pro and Dixell xweb, all reachable over the internet. Earlier research and CISA advisories describe authentication bypass and OS command execution flaws in these products, and CISA's Copeland advisory cites nearly two dozen CVEs (also DoS, memory corruption, arbitrary code execution). An attacker with network reach to an exposed admin panel could change setpoints and force defrost cycles. Danfoss fixed its flaws in firmware R4.3.1. Danfoss and Copeland say most compromised units are legacy or end-of-life and get no updates.

Como funciona

The controllers manage refrigeration and are connected to the internet, sometimes through 3G cards, for temperature monitoring, alarms and remote maintenance. Attackers reportedly found exposed devices, possibly with Shodan, and reached their web admin interface. Once they had control, they used legitimate functions: forcing continuous defrost and rewriting setpoints, for example from -22°C to 150°C several times per second at a store near Bordeaux, which suggests automation. The step where access control failed (authentication bypass, command execution or weak credentials) is not confirmed in the reporting.

Por que é vulnerável

The reporting points to a combination of causes rather than one confirmed root cause. Known authentication bypass and command execution bugs existed in the controller software, some dating back to 2023 and some rated critical. Many devices ran outdated firmware or were end-of-life with no patches, and admin panels were exposed directly to the internet instead of sitting behind a VPN or APN gateway. Claroty's Preminger notes that patching alone does not make exposure safe. The sources do not say what the fix changes in code.

Como foi descoberta

The attack began on the night of 11-12 October 2026 and was confirmed by retailers on 12 October. ANSSI warned about Danfoss equipment, and CERT-FR's 12 October advisory later added Dixell/Copeland xweb. The Paris prosecutor's cybercrime unit opened an investigation. The underlying flaws were found earlier: CISA advisories (Danfoss in May 2025, Copeland in February) and Claroty Team82 research in August describing dozens of vulnerabilities. The initial access method is unconfirmed, and no group has claimed the attack.

Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 00:24.

Detalhes técnicos

  • Affected products: Danfoss AK-SM800 and AK-SC355 controllers, with an affected AK-SM800 running outdated firmware (itsecurityguru.org). Danfoss AK-SM 800A / AK-SM 8xxA series and Copeland XWEB / XWEB Pro controllers, plus Dixell systems named by ANSSI (theregister.com). Danfoss said most compromised units were legacy products that no longer receive updates (itsecurityguru.org). Copeland said the issue affects a discontinued, end-of-life generation (theregister.com).
  • Observed behaviour: Per BFM TV, refrigeration units were forced into continuous defrost (itsecurityguru.org). At a store near Bordeaux, freezer setpoints were changed from −22°C to 150°C several times per second, which suggests automation. An E.Leclerc store in the Tarn region had disrupted Dixell-based refrigeration (infosecurity-magazine.com).
  • Operator involvement: Claroty CTO Amir Preminger called the attack unsophisticated but deliberate, because a defrost must be initiated and so an operator guided the campaign (infosecurity-magazine.com).
  • Known vulnerabilities: The flaws were publicly known. CISA advisories (May 2025 for Danfoss, February for Copeland) and Claroty Team82 research in August described authentication bypass and OS command execution issues (theregister.com). CISA's Copeland XWEB advisory cited nearly two dozen CVEs covering authentication bypass, denial of service, memory corruption and arbitrary code execution (theregister.com). No source gives CVE IDs, IOCs or threat actors.
  • Danfoss patch: Firmware R4.3.1 was released about two months before the attacks (theregister.com).
  • Exposure: Reports suggest attackers may have used Shodan to find exposed devices, some connected via 3G cards for remote monitoring (itsecurityguru.org). Claroty found many such controllers directly exposed to the internet, including outside France, in Israel and the US, though Preminger did not know their versions or vulnerability status (infosecurity-magazine.com). Coalition scanning between 7 September and 6 October found 1,506 unique IPs exposing a Danfoss StoreView admin panel, 820 (54%) of them on French networks. It counted at least 2,624 controllers with open login pages (1,506 Danfoss StoreView, 1,119 XWEB). Exposure does not necessarily mean a device was vulnerable. As of Thursday (15 October), 618 Danfoss devices were still internet-connected: 206 in France, 50 in the US and 2 in the UK (theregister.com).
  • Why the devices are online: Supermarket refrigeration is connected to meet European requirements for timestamped temperature monitoring and alarms, and for remote maintenance (infosecurity-magazine.com).
  • Context: Preminger compared the case, without linking the two, to a 2025 incident at an Israeli food-processing facility where an attacker inside the network forced a compressor to defrost (infosecurity-magazine.com).
  • Impact: Intermarché's CEO estimated losses of tens of millions of euros nationwide in one day. Coopérative U said larger stores could each lose €180,000-200,000 in stock (itsecurityguru.org). Sekoia reports stores in Spain, Portugal, Poland, Germany and Belgium were also affected (itsecurityguru.org).

Remediação

  • Remove refrigeration and other OT controllers from direct internet exposure. Place admin panels behind a corporate VPN, APN gateway or access controls. Patching alone does not make internet exposure safe (infosecurity-magazine.com, theregister.com).
  • Apply vendor firmware updates (for example Danfoss R4.3.1) and replace end-of-life Danfoss and Copeland/Dixell controllers with supported products (itsecurityguru.org, theregister.com).
  • Replace default passwords, restrict remote access, and enable MFA where supported (itsecurityguru.org).
  • Segment OT networks, inventory equipment, and know who can access each device. Monitor for unusual changes in system behaviour (itsecurityguru.org, infosecurity-magazine.com).
  • Inventory third parties with remote access and test the ability to switch to manual operation (itsecurityguru.org).
  • Review the CERT-FR advisory of 12 October for the affected products (infosecurity-magazine.com).
  • The Operational Technology Cybersecurity Coalition called for a CISA Binding Operational Directive and for USDA to encourage OT baseline security in the food and agriculture sector (theregister.com).

Relatos divergentes

  • Vendors affected: itsecurityguru.org (13 October) traced the attack only to Danfoss. infosecurity-magazine.com (14 October) and theregister.com (15 October) add Copeland and its Dixell brand, citing CERT-FR and ANSSI. The later reports are more complete.
  • Scale: itsecurityguru.org gives per-chain counts: at least 300 Intermarché/Netto stores, more than 100 Coopérative U and 80 Carrefour, with Monoprix, E.Leclerc and Auchan also affected. theregister.com, the most recent source, reports nearly 700 stores and thousands of compromised controllers. The sources do not reconcile these figures, and the two may not be directly comparable.
  • Models: itsecurityguru.org names AK-SM800 and AK-SC355. theregister.com names AK-SM 800A / 8xxA and XWEB / XWEB Pro. infosecurity-magazine.com cites the CERT-FR families AK-SC and AK-SM, which is the broader formulation.
  • Geography: itsecurityguru.org (citing Sekoia) reports impact in other European countries. The other two sources focus on France.
  • Vulnerability status: itsecurityguru.org says ANSSI identified a vulnerability and notes known flaws since 2023. theregister.com says the flaws were publicly documented by CISA and Claroty Team82. infosecurity-magazine.com says Preminger did not know whether the exposed devices elsewhere are vulnerable. The exact exploited flaw remains unconfirmed.

Linha do tempo

  1. infosecurity-magazine.com ↗ · pub. 14/10/2026 06:30 · coletado 20/10 16:31

    Cyber-attack on French supermarket refrigeration controllers extends beyond Danfoss to Dixell/Copeland devices

    ler a análise desta fonte

    A cyber-attack that began on October 11 against refrigeration controllers in French supermarkets is larger than first reported. It now appears to affect Dixell Electronics (a Copeland brand) temperature regulation devices as well as Danfoss controllers. CERT-FR named Danfoss AK-SC and AK-SM series, Dixell xweb and Copeland xweb as affected systems in an advisory on October 12. French media reported an E. Leclerc store in the Tarn region with disrupted Dixell-based refrigeration, and a store near Bordeaux where freezer setpoints were changed from −22°C to 150°C, several times per second, which suggests automation. The actor and the initial access method have not been identified.

    Technical Details

    • Claroty CTO Amir Preminger assessed the attack as unsophisticated but deliberate: a defrost must be initiated, so the campaign was guided by an operator.
    • Claroty research found many such controllers directly exposed to the public internet. Preminger said exposed Danfoss devices also exist outside France, including in Israel and the US, but he did not know their software versions or whether they are vulnerable.
    • He drew a comparison, without linking the two, to a 2025 incident at an Israeli food-processing facility in which an attacker inside the network forced a refrigeration compressor to defrost.
    • Supermarket refrigeration is internet-connected to meet European requirements for timestamped temperature monitoring and alarms, and to allow remote maintenance.
    • The article names no CVEs, IOCs or threat actors.

    Remediation

    • Keep critical controllers off the public internet and restrict access through corporate VPNs or APN gateways. Patching alone does not make internet exposure safe.
    • Segment networks, inventory equipment and know who can access each device.
    • Review the CERT-FR advisory of October 12 for the affected Danfoss and Dixell/Copeland products.
  2. itsecurityguru.org ↗ · pub. 13/10/2026 07:31 · coletado 19/10 17:55

    Coordinated OT attack on Danfoss refrigeration controllers hits hundreds of French supermarkets, causing fires and stock losses

    ler a análise desta fonte

    A coordinated attack on the operational technology behind supermarket refrigeration hit hundreds of stores in France from the night of 11-12 October 2026. Intermarché/Netto reported at least 300 affected shops, Coopérative U more than 100 and Carrefour 80, with Monoprix, E.Leclerc and Auchan also reporting impacted stores. Per BFM TV, attackers remotely forced refrigeration units into continuous defrost cycles, raising temperatures to 50°C. Paris prosecutors said the attack also caused fires. No group has claimed responsibility, and there is no evidence of a ransom demand or data theft. Sekoia reports stores in Spain, Portugal, Poland, Germany and Belgium were also affected.

    Technical Details

    • The equipment was traced to Danfoss refrigeration management systems. Danfoss said most compromised units were legacy products that no longer receive updates, naming the AK-SM800 and AK-SC355 controllers, and said an affected AK-SM800 ran outdated firmware.
    • ANSSI reportedly identified a vulnerability in Danfoss software. The article gives no CVE identifiers, but notes known flaws in the control software dating back to 2023, some rated critical, with patches available. In August, Claroty published research on authentication-bypass flaws in Danfoss systems.
    • Reports suggest attackers may have used Shodan to locate exposed devices, some connected via 3G cards for remote monitoring.
    • The exact access method is still unclear.
    • Intermarché's CEO estimated losses of tens of millions of euros nationwide in a single day. Coopérative U said larger stores could each lose €180,000-200,000 in stock.
    • The Paris prosecutor's cybercrime unit has opened an investigation, and ANSSI is coordinating with European counterparts.

    Remediation

    • Identify controllers and management interfaces reachable from the internet and remove unnecessary exposure.
    • Upgrade or replace end-of-life Danfoss models, and apply available firmware and software updates.
    • Replace default passwords, restrict remote access, and enable MFA where supported.
    • Segment OT control networks from other networks and monitor for unusual changes in system behaviour.
    • Inventory third parties holding remote access, and test the ability to switch to manual operation.
  3. theregister.com ↗ · pub. 15/10/2026 16:23 · coletado 19/10 17:54 primeiro registro

    Danfoss and Copeland refrigeration controllers hacked across ~700 French supermarkets despite earlier vulnerability warnings

    ler a análise desta fonte

    Unknown attackers compromised thousands of internet-exposed refrigeration controllers late on Sunday, raising temperatures to as high as 122°F (50°C), spoiling food and causing fires at nearly 700 French supermarkets. France's ANSSI warned of widespread compromises of Danfoss controllers and a day later added Copeland and its Dixell brand. Many affected devices were end-of-life, no longer receiving updates, or running outdated firmware. The flaws were publicly known: CISA advisories (May 2025 for Danfoss, February for Copeland) and Claroty Team82 research in August had already described authentication bypass and OS command execution issues. No attribution has been made.

    Technical Details

    • Affected products: Danfoss AK-SM 800A / AK-SM 8xxA series and Copeland XWEB / XWEB Pro controllers, plus Dixell systems named by ANSSI.
    • Team82 published dozens of vulnerabilities, including authentication bypass and operating-system command execution. CISA's February advisory for Copeland XWEB cited nearly two dozen CVEs allowing authentication bypass, denial of service, memory corruption and arbitrary code execution. The article gives no CVE IDs.
    • Danfoss released firmware R4.3.1 to mitigate the flaws about two months before the attacks.
    • Coalition scanning between September 7 and October 6 found 1,506 unique IPs exposing a Danfoss StoreView admin panel, 820 (54%) on French networks. It counted at least 2,624 controllers with open login pages (1,506 Danfoss StoreView, 1,119 XWEB). Exposure does not necessarily mean the devices were vulnerable.
    • As of Thursday, 618 Danfoss devices were still internet-connected: 206 in France, 50 in the US and 2 in the UK.
    • Copeland said the issue affects a discontinued, end-of-life generation of controllers.

    Remediation

    • Remove refrigeration and other OT controllers from direct internet exposure and place admin panels behind VPN or access controls.
    • Apply vendor firmware updates (e.g., Danfoss R4.3.1) and replace end-of-life controllers with supported products.
    • Monitor for exposed OT interfaces. The Operational Technology Cybersecurity Coalition called for a CISA Binding Operational Directive and for USDA to encourage food and agriculture sector adoption of baseline OT security practices.