Editorial analysis · Primary sources

France confirms broad refrigeration-controller compromise as attacks may still be continuing

CERT-FR has expanded the French supermarket refrigeration incident from several reported stores to numerous confirmed compromises across Danfoss, Copeland and Dixell controller families, warning that attack campaigns are probably still active.

Event: 2026-10-12 · Disclosure: 2026-10-12
Updated: 2026-10-15T06:20:00.000Z · Confidence: medium

Incident, disclosure and update

The operational incident began during the night of 11–12 October 2026. On 12 October, Coopérative U president Dominique Schelcher publicly confirmed cyberattacks affecting cold-production installations at several stores [1]. CERT-FR issued its first alert that day and updated it on 13 October to add further targeted equipment. The official bulletin now reports numerous compromises involving Danfoss AK-SM and AK-SC controllers and Copeland/Dixell xweb systems [2].

What changed

The update materially expands the exposure beyond one retailer and one vendor family. CERT-FR says attack campaigns are probably still under way and warns that factory-resetting a compromised controller is insufficient if an unsupported or unpatched device remains exposed to the public Internet: it is likely to be compromised again [2]. This remains a confirmed operational-technology intrusion; the public primary sources do not establish a specific exploited CVE, malware family or actor.

Who should assess exposure

Food retailers, cold-storage and logistics operators, facilities teams and refrigeration service providers should identify affected product families, public IP exposure, end-of-life firmware and third-party remote-access paths. Review activity from at least 11 October for changes to temperature set-points, defrost schedules, alarms, users and network configuration. Include supplier-managed assets even when they sit outside the corporate IT inventory.

Response and mission priorities

For uncompromised units, CERT-FR recommends removing direct Internet exposure, validating the full configuration and restoring access only through a secure VPN or protected network. For compromised units, remove exposure, perform a factory reset, reconfigure and update before reconnection [2]. Preserve controller, firewall, identity and supplier-access evidence first where feasible. Independently verify temperatures and product safety, prepare manual operations and coordinate recovery across security, facilities, food safety, legal, communications and suppliers. NIST guidance supports integrating response with wider risk management and recovery [4].

Governance, unknowns and confidence

Executive owners should require supported firmware, changed default passwords, strict security modes, independent logging, contractual incident access and tested isolation procedures. Exact victim count, initial access method, attacker identity, intent and complete physical consequences remain unverified in the reviewed primary record. Confidence is high that multiple controller families were compromised and that continuing exposure creates re-compromise risk; confidence in total scope and cause remains medium.

Sources

Francisco Javier Jurado Alonso