For years, security researchers have warned about building-management gear sitting on the open internet. In October, French supermarkets found out what that costs. Attackers got into the remote controllers that run commercial refrigeration at grocers across France, and in some stores they forced chillers and freezers into a continuous defrost cycle at 50C (122F). Nobody has claimed responsibility. Danfoss and Copeland say or acknowledge that the affected hardware is end-of-life, and the EU's new product-security law does not require anyone to fix it.

On October 12, France's national cyber emergency team, CERT-FR, published alert CERTFR-2026-ALE-012 and updated it on October 16. The alert reports "numerous" compromises of four product families: Danfoss AK-SM and AK-SC system managers, and Copeland xweb and Dixell xweb remote controllers. These are the remote controllers for refrigeration installations. CERT-FR says that exposing a management interface to the internet goes against good practice.

Who was hit, and how badly

The Record reported on October 20 that stores belonging to Intermarché, Carrefour, Monoprix, Leclerc and Coopérative U were affected. Losses are estimated in the tens of millions of euros, mostly from spoiled food stock that had to be thrown away. The Register reported on October 13 that the chains involved included Carrefour, Coopérative U, Intermarché and Monoprix, and that the manufacturer said the affected stores were running outdated firmware.

The Paris prosecutor's office told The Record it had received "about ten complaints" and estimated the "number of victims at around 700." The prosecutor's office said that to date no perpetrator has claimed responsibility. None of the sources attributes the attacks to a particular group or country.

How did the attackers get in?

This has not been publicly established. The Register reported that authorities have not identified the entry point or confirmed exploitation of the vulnerabilities previously disclosed by Claroty and patched in August 2025. Danfoss said the affected French stores were running outdated firmware.

Some vulnerabilities in this equipment are already public. The Register notes that Claroty found a hidden authentication mechanism in Danfoss's AK-SM 800A platform that accepted a code generated from the device's current date, bypassing the configured administrator password. Danfoss patched those flaws in August 2025, and their role in the French attacks remains unconfirmed. The Register also reported that CERT-FR saw compromised AK-SM and AK-SC controllers that Claroty's original reporting and Danfoss's advisories did not mention at the time. In other words, the known Danfoss bugs may explain only part of what happened.

Another Danfoss record is public too. The U.S. National Vulnerability Database lists CVE-2025-41450, an improper-authentication flaw affecting Danfoss AK-SM 8xxA Series before version 4.2. The NVD record carries a CVSS 3.1 score of 8.2 (High) from the Danfoss-linked source, refers to Danfoss advisory DSA-2025-03-01, and was last modified on October 19, 2026. The sources do not tie that CVE to the French intrusions.

The Copeland side has a longer record. In February 2026, months before these attacks, CISA published ICS advisory ICSA-26-057-10 covering Copeland XWEB 300D PRO, 500D PRO and 500B PRO through version 1.12.1. It lists 23 CVEs. The most serious is CVE-2026-21718, an authentication bypass that allows pre-authenticated code execution, rated 10.0 (Critical) on CVSS 3.1. The others include several OS command injection flaws, some of which need no authentication (for example CVE-2026-24663, also rated 10.0 Critical), an unauthenticated stack buffer overflow in an API route (CVE-2026-20797), and an unauthenticated arbitrary file read (CVE-2026-22877). That advisory does not describe the French incident, and CISA said at the time that no known public exploitation of these vulnerabilities had been reported to it. It does show that Copeland's xweb line, one of the families CERT-FR named, had critical, unauthenticated bugs on record well before October.

According to The Record, Copeland acknowledged "the vulnerability identified in a discontinued, end-of-life generation of controllers." Danfoss has said its affected units were end-of-life as well.

Why the EU's new law doesn't help much here

"End-of-life" matters because of the EU Cyber Resilience Act (CRA). Its provisions requiring manufacturers to report actively exploited vulnerabilities and severe incidents took effect last month. ENISA, the EU cybersecurity agency, told The Record that this obligation covers end-of-life products "no longer sold in the EU, but which remain in use." The law's separate obligations to handle vulnerabilities, including fixing them and issuing free security updates, apply only during a product's support period. For a product whose support has ended, as with the controllers targeted here, ENISA said "the manufacturer is not required to comply with the vulnerability handling obligations."

The result is that regulators may get reports about flaws being exploited in old refrigeration controllers, but the law does not require a vendor to ship a patch for hardware it no longer supports. The Record notes that replacing aging equipment can be costly and disruptive, and that guidance typically recommends isolating such systems on segmented networks and limiting internet access. In practice, that leaves the decision to the operators of the equipment.

What It Means for Defenders

Who is affected: any organization running Danfoss AK-SM or AK-SC system managers, or Copeland/Dixell xweb controllers, especially where the web management interface can be reached from the internet. Grocers are the obvious targets, but The Register notes the affected equipment also includes cold-storage units used to hold food before it reaches supermarket shelves. CERT-FR also mentions the refrigeration contractor's remote data link, so ask any contractor who manages your system how it is reached remotely.

What CERT-FR tells operators to do:

  • Take it off the internet. Remove direct internet exposure of the management interface. Restore remote access only through a secure VPN or another protected network. CERT-FR says filtering to the contractors' source IP addresses at a firewall is acceptable in an emergency but should not be considered a lasting fix.
  • Treat exposed Danfoss units as possibly compromised. For compromised equipment, CERT-FR advises restarting the Danfoss controller or restoring it with a factory reset, then reconfiguring it before returning it to service.
  • Check defrost schedules. The attacks changed refrigeration behavior, so verify the full configuration, including the defrost time ranges.
  • Apply the manufacturer's recommended practices. For Danfoss equipment, CERT-FR's examples are updating the firmware, setting the security level to Strict, and making sure default passwords have been changed.
  • Check your insurance terms before cutting the data link to your refrigeration contractor; CERT-FR advises verifying the contractual conditions first.

Copeland XWEB Pro: CISA's advisory says Copeland has provided a fix for the vulnerabilities and recommends updating XWEB Pro to the latest version from Copeland's software update page, or through the device's own update menu if it has internet access. Given the 10.0-rated authentication bypass on the list, any unpatched unit that can be reached from the internet deserves to be treated as at high risk of compromise.

Danfoss AK-SM 8xxA: check your firmware against Danfoss advisory DSA-2025-03-01, which the NVD entry for CVE-2025-41450 references, and against the August 2025 patches for the AK-SM 800A flaws Claroty reported. Danfoss said the French stores were running outdated firmware.

End-of-life hardware: Danfoss has said its affected units are end-of-life, Copeland acknowledged the issue in a discontinued generation, and ENISA says the CRA does not require fixes for products whose support has ended, so you may not get another patch. CERT-FR warns that keeping an unpatched end-of-life device exposed to the internet means a very high probability of compromise, and that a factory reset alone is insufficient there: it removes the attacker's persistence but leaves the device vulnerable. Network isolation is the control you can rely on. Plan to replace the hardware, and keep it off the internet until you do. For CMMC-minded contractors and other regulated shops, the same logic applies to any operational technology in your facilities: if a device is out of support, put it in your asset inventory and isolate it, not just your IT endpoints.

Monitoring: consider setting temperature alarms that reach a person outside the controller's own interface, since a compromised controller may not be a trustworthy witness to its own readings.

Sources