Supermarket refrigeration attacks: restrict exposed controller access
Incident analysis
CERT-FR documents refrigeration-controller compromises; November 2 reporting describes further store disruption in Belgium and Sweden. Check exposed administration and unexpected settings without assuming one shared attacker or CVE.
Who should check: Retailers, cold-storage operators and refrigeration contractors with exposed controller administration or suspected unauthorized changes. The exact products in the November reports remain unverified.
Restrict remote administration, compare controller settings and alarm delivery with the approved baseline, and coordinate recovery with refrigeration operations.
What happened and why does it matter?
CERT-FR first alerted on October 12 and revised its advice on October 16. It documents compromises involving Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controls. This record covers the operational incident pattern, not a newly disclosed vulnerability.
EL PAÍS reports further disruption overnight before November 2 at Swedish ICA stores and more than 40 Delhaize locations in Belgium. The report does not establish a common attacker, CVE or controller model across the new cases. Loss estimates for the earlier French incidents must not be reused as a total for November.
Copeland distinguishes unsupported XWEB EVO from its supported XWEB PRO platform; neither should have public management exposure. Recovery and replacement depend on the exact equipment. There is no universal fixed version for this incident record.
Oktsec recommends a joint review by IT, refrigeration maintenance and store operations. Confirm which remote users can change settings, whether unexpected changes occurred and whether an independent temperature observation agrees with the controller. The linked Research article explains the control path and inventory decisions. Evidence of compromise elsewhere does not establish that the reader’s systems are affected.
- Vendor / publisher
- Danfoss / Copeland / Dixell
- Disclosed
- Oct 12, 2026
- Latest evidence check
- Nov 2, 2026 UTC
What evidence supports this advisory?
Incident evidence
Priority rationale
CERT-FR confirms controller compromises. Act now for exposed administration or suspected manipulation because operational settings affect the cold chain. The November reports do not identify a common CVE or prove every installation is affected.
What does this mean for AI environments?
No AI involvement is established. Operational access and controller configuration are the relevant issues in this incident.
Sources behind this advisory
- CERT-FR refrigeration-controller alert; guidance revised October 16CERT-FR / ANSSI · Checked Nov 2, 2026 UTC
- Copeland/Dixell XWEB security and recovery bulletin, October 14Copeland Controls / Dixell France · Checked Nov 2, 2026 UTC
- EL PAÍS: further European supermarket refrigeration incidents, November 2EL PAÍS · Checked Nov 2, 2026 UTC
Editorial record1 entry
Added the October CERT-FR incident scope and November 2 reporting, with exposed-access and operational recovery checks. No common CVE or attacker is established.
Plan your response
Use this checklist to decide whether the advisory affects your systems, record what your team does and share the result. Radar does not scan or verify your environment.
Changes save automatically in this browser. They are not synced with your team or sent to Oktsec.
1. Check whether this applies
Read the advisory and its sources, then record your decision below. If you are unsure, choose “Needs verification”.
2. Track the response
Name the system and person or team handling the work. Update each action as you go; add a ticket reference or notes to explain what was checked.
Identify equipment and remote access owners
Record each site, exact model, firmware, support status and contractor. Have the network owner verify the administration path. CERT-FR names product families in the October incidents; this is not a firmware-range list or proof of compromise at your site.
Add evidence or notes
Use references only. Do not store credentials or confidential data here.Remove public administration exposure
Coordinate access restrictions with operations and the service provider, preserving essential cooling and monitoring. Use an approved protected maintenance path. Do not confuse disconnecting public management access with switching off refrigeration.
Add evidence or notes
Use references only. Do not store credentials or confidential data here.Verify settings, alarms and actual temperatures
Compare setpoints, defrost schedules and alarm recipients with the approved baseline. Ask the refrigeration team to verify physical conditions and alert receipt. Escalate stock-handling decisions to the responsible food-safety team; a responsive dashboard is insufficient.
Add evidence or notes
Use references only. Do not store credentials or confidential data here.Preserve evidence and follow model-specific recovery
For suspected compromise, retain available access records and configuration evidence where safe. Use the vendor procedure with the technician. XWEB EVO is end of service; plan migration to a supported platform. A reset alone does not remove exposure or restore security support.
Add evidence or notes
Use references only. Do not store credentials or confidential data here.
3. Share the plan
Download a Markdown file with your decision, action status, notes and source links. Share it with your team or attach it to a ticket.
Affected systems & fixes
Compare the running version and configuration with the vendor guidance.
| Product | Affected | Fixed release / action |
|---|
Confirm distribution backports with the vendor. A matching product alone does not establish exposure.
Evidence & sources
Why this priority
CERT-FR confirms controller compromises. Act now for exposed administration or suspected manipulation because operational settings affect the cold chain. The November reports do not identify a common CVE or prove every installation is affected.
Prioritization criteriaSources
Technical facts come from these sources. Response priorities and recommended actions are Oktsec’s analysis.
- CERT-FR refrigeration-controller alert; guidance revised October 16CERT-FR / ANSSI · Government advisory · Checked Nov 2, 2026 UTC
- Copeland/Dixell XWEB security and recovery bulletin, October 14Copeland Controls / Dixell France · Vendor notice · Checked Nov 2, 2026 UTC
- EL PAÍS: further European supermarket refrigeration incidents, November 2EL PAÍS · Media report · Checked Nov 2, 2026 UTC
Technical recordProducts, identifiers and supporting details
| Product / service | Danfoss AK-SM and AK-SC (October CERT-FR scope), Copeland / Dixell XWEB (October CERT-FR scope)Danfoss / Copeland / Dixell |
|---|---|
| Evidence | Incident documented by multiple sources |
| Exposure | Application or configuration dependent |
| Fix / response | Additional action required |
- Disclosed
- Oct 12, 2026
- Record reviewed
- Nov 2, 2026 UTC
For AI agent environments
No AI involvement is established. Operational access and controller configuration are the relevant issues in this incident.