Danfoss and Copeland refrigeration controllers hacked across ~700 French supermarkets despite earlier vulnerability warnings
Unknown attackers compromised thousands of internet-exposed refrigeration controllers late on Sunday, raising temperatures to as high as 122°F (50°C), spoiling food and causing fires at nearly 700 French supermarkets. France's ANSSI warned of widespread compromises of Danfoss controllers and a day later added Copeland and its Dixell brand. Many affected devices were end-of-life, no longer receiving updates, or running outdated firmware. The flaws were publicly known: CISA advisories (May 2025 for Danfoss, February for Copeland) and Claroty Team82 research in August had already described authentication bypass and OS command execution issues. No attribution has been made.
Technical Details
- Affected products: Danfoss AK-SM 800A / AK-SM 8xxA series and Copeland XWEB / XWEB Pro controllers, plus Dixell systems named by ANSSI.
- Team82 published dozens of vulnerabilities, including authentication bypass and operating-system command execution. CISA's February advisory for Copeland XWEB cited nearly two dozen CVEs allowing authentication bypass, denial of service, memory corruption and arbitrary code execution. The article gives no CVE IDs.
- Danfoss released firmware R4.3.1 to mitigate the flaws about two months before the attacks.
- Coalition scanning between September 7 and October 6 found 1,506 unique IPs exposing a Danfoss StoreView admin panel, 820 (54%) on French networks. It counted at least 2,624 controllers with open login pages (1,506 Danfoss StoreView, 1,119 XWEB). Exposure does not necessarily mean the devices were vulnerable.
- As of Thursday, 618 Danfoss devices were still internet-connected: 206 in France, 50 in the US and 2 in the UK.
- Copeland said the issue affects a discontinued, end-of-life generation of controllers.
Remediation
- Remove refrigeration and other OT controllers from direct internet exposure and place admin panels behind VPN or access controls.
- Apply vendor firmware updates (e.g., Danfoss R4.3.1) and replace end-of-life controllers with supported products.
- Monitor for exposed OT interfaces. The Operational Technology Cybersecurity Coalition called for a CISA Binding Operational Directive and for USDA to encourage food and agriculture sector adoption of baseline OT security practices.
Linha do tempo
-
Danfoss and Copeland refrigeration controllers hacked across ~700 French supermarkets despite earlier vulnerability warnings
ler a análise desta fonte ocultar
Unknown attackers compromised thousands of internet-exposed refrigeration controllers late on Sunday, raising temperatures to as high as 122°F (50°C), spoiling food and causing fires at nearly 700 French supermarkets. France's ANSSI warned of widespread compromises of Danfoss controllers and a day later added Copeland and its Dixell brand. Many affected devices were end-of-life, no longer receiving updates, or running outdated firmware. The flaws were publicly known: CISA advisories (May 2025 for Danfoss, February for Copeland) and Claroty Team82 research in August had already described authentication bypass and OS command execution issues. No attribution has been made.
Technical Details
- Affected products: Danfoss AK-SM 800A / AK-SM 8xxA series and Copeland XWEB / XWEB Pro controllers, plus Dixell systems named by ANSSI.
- Team82 published dozens of vulnerabilities, including authentication bypass and operating-system command execution. CISA's February advisory for Copeland XWEB cited nearly two dozen CVEs allowing authentication bypass, denial of service, memory corruption and arbitrary code execution. The article gives no CVE IDs.
- Danfoss released firmware R4.3.1 to mitigate the flaws about two months before the attacks.
- Coalition scanning between September 7 and October 6 found 1,506 unique IPs exposing a Danfoss StoreView admin panel, 820 (54%) on French networks. It counted at least 2,624 controllers with open login pages (1,506 Danfoss StoreView, 1,119 XWEB). Exposure does not necessarily mean the devices were vulnerable.
- As of Thursday, 618 Danfoss devices were still internet-connected: 206 in France, 50 in the US and 2 in the UK.
- Copeland said the issue affects a discontinued, end-of-life generation of controllers.
Remediation
- Remove refrigeration and other OT controllers from direct internet exposure and place admin panels behind VPN or access controls.
- Apply vendor firmware updates (e.g., Danfoss R4.3.1) and replace end-of-life controllers with supported products.
- Monitor for exposed OT interfaces. The Operational Technology Cybersecurity Coalition called for a CISA Binding Operational Directive and for USDA to encourage food and agriculture sector adoption of baseline OT security practices.