We wrote on Oct 12 about attackers forcing defrost cycles on Danfoss controllers overnight. CERT-FR updated its alert (CERTFR-2026-ALE-012) on Oct 13 to add Copeland and Dixell XWEB, and Copeland has since acknowledged a vulnerability and says it's working with affected customers. Cooling Post reported Dixell-equipped stores in Bordeaux and Lescure-d'Albigeois were hit the night of Oct 13, and CERT-FR warns campaigns are likely still under way.
Who's hit. Carrefour, Coopérative U, E.Leclerc, Intermarché and Monoprix have confirmed it. Carrefour says 80 stores. Les Mousquetaires says about 150 Intermarché stores, where cases ran at 50°C for six hours and all food was thrown out. Coopérative U says 80 stores were targeted but only a minority discarded stock. Le Monde reports the attackers stretched defrost cycles from one hour to as many as eight, which delayed alarms. Paris prosecutors say the attack also caused fires. Sekoia told Reuters stores in Spain, Portugal, Poland, Germany and Belgium were affected too, without details. The Dutch NCSC doesn't think Ahold Delhaize's incident is connected.
How they got in: still unknown. CERT-FR hasn't tied the compromises to a specific CVE, and nobody has linked them to the Danfoss and Copeland flaws Claroty published this summer. Danfoss says most affected units are end-of-life AK-SM 800 (unsupported since May 2021) and AK-SC 355 (discontinued 2016) systems, plus some AK-SM 800A units on old firmware. CERT-FR's warning is blunt: an end-of-life controller left on the internet will almost certainly be compromised again, and a factory reset alone doesn't fix that.
The tell in the Censys data. Censys counted nearly 3,000 internet-exposed Danfoss StoreView panels on Oct 11, more than 1,800 of them in France. By Oct 14 the French count was 537. Patched and unpatched units disappeared at about the same rate, which says operators are unplugging, not updating. That's the right first move. It also means the same exposure is still sitting outside France.
What we'd do this week if we ran security for a retailer, cold-chain warehouse or food distributor anywhere. Ask facilities and the refrigeration contractor for a list of every Danfoss, Copeland and Dixell controller and how it's reached remotely. Take management interfaces off the internet and put contractor access behind a VPN. CERT-FR says IP filtering is only a stopgap. Change default passwords, check defrost schedules and setpoints against what they should be, and route temperature and defrost alarms to someone who's awake at 2 a.m. Then settle who owns the loss. Les Mousquetaires says Danfoss managed the systems, so it's up to the supplier to file the complaint (per Bloomberg). Read your contracts and policies before you need them.