The cyberattack that disrupted refrigeration at hundreds of French supermarkets has widened from an incident involving Danfoss equipment to a broader warning for owners of internet-connected refrigeration controls, including Copeland and Dixell XWEB systems.
For refrigeration contractors and facility managers, the immediate lesson is practical: supervisory controllers should not be exposed directly to the public internet. French cybersecurity authorities have told operators to disconnect affected controllers from the internet and restore remote access only through a secure VPN or protected network.
The Alert Expanded Beyond Danfoss
France’s CERT-FR first warned Oct. 12 about compromises involving Danfoss AK-SM and AK-SC refrigeration controllers. The following day, the agency expanded its alert to include Copeland XWEB and Dixell XWEB systems, according to SecurityWeek’s review of the French alert.
About 700 French supermarkets were affected, French Finance Minister Roland Lescure told lawmakers. Reported effects included altered refrigeration operation and food losses. Investigators have not publicly identified the attacker or established the initial access method.
That uncertainty matters because known vulnerabilities are not proof that a particular vulnerability caused an incident. Security researchers have disclosed flaws in both Danfoss and Copeland controller families, but French authorities and the manufacturers have not publicly tied the supermarket compromises to one specific flaw.
Internet Exposure Is the Common Operational Risk
Internet scanning cited by security researchers has found thousands of refrigeration-management interfaces reachable online. SecurityWeek reported that Censys counted nearly 3,000 internet-exposed Danfoss StoreView control panels on Oct. 11, including more than 1,800 in France. After the attacks became public, the French count fell sharply as operators disconnected systems.
More Read
That response highlights a distinction technicians should make between remote access and public exposure. A customer may have a legitimate need for remote diagnostics, alarms or service access. That does not require placing the controller’s administrative interface directly on the open internet.
Current Controllers Have Security Updates Available
Danfoss has released security-focused software for its current AK-SM 800A family. Its version 4.3.1 update added protections including stronger password requirements for new accounts, hardened update handling, input sanitization and TLS 1.2 support. Danfoss has since continued releasing newer software for the 800A platform.
Copeland released XWEB PRO firmware version 1.13 in February 2026 after identifying vulnerabilities in XWEB PRO monitoring units. In its security bulletin, Copeland said operators should not expose control systems to the broader internet, should restrict administrative protocols with firewalls, change default passwords and enable HTTPS without making the web interface publicly reachable.
Older equipment is a harder problem. Danfoss said many systems affected in France were end-of-life AK-SM 800 and AK-SC 355 controllers. An unsupported controller can remain operational for refrigeration purposes while no longer receiving security patches, creating a replacement decision that looks more like an IT lifecycle issue than a conventional refrigeration failure.
Questions to Ask a Refrigeration Contractor
- Is the refrigeration controller or its web interface directly reachable from the public internet?
- If remote access is required, does it pass through a VPN or another protected network controlled by the customer?
- Is the controller still supported by its manufacturer, and is its firmware current?
- Have default credentials been changed, and are administrator accounts limited to people who need them?
- Who is responsible for controller cybersecurity: the refrigeration contractor, an IT provider, the equipment vendor or the facility owner?
Technicians should not make network changes outside their authorization or expertise. The useful service role is to identify the controller, document its software version and connectivity, and coordinate with the customer’s IT or operational-technology team on access controls.
The French attacks show why that coordination can no longer be treated as optional paperwork. A refrigeration controller is part of the cold chain, but once it is networked, it is also a computer controlling physical equipment. Both sides of that job need maintenance.
