# Supermarket refrigeration attacks: restrict exposed controller access Canonical: https://www.oktsec.com/radar/refrigeration-controller-attacks-europe-2026 Publisher: Oktsec Language: en Published: 2026-11-02T12:48:28Z Updated: 2026-11-02T13:04:52Z Record reviewed: 2026-11-02T13:04:52Z Latest evidence check: 2026-11-02T13:04:52Z Disclosed: 2026-10-12 CERT-FR documents refrigeration-controller compromises; November 2 reporting describes further store disruption in Belgium and Sweden. Check exposed administration and unexpected settings without assuming one shared attacker or CVE. ## Evidence and response priority - Category: Platform incident - Oktsec priority: Act now - Rationale: CERT-FR confirms controller compromises. Act now for exposed administration or suspected manipulation because operational settings affect the cold chain. The November reports do not identify a common CVE or prove every installation is affected. - Evidence: Incident documented by multiple sources - Verification: Multiple sources - Fix status: Additional action required - Exposure requirement: Application or configuration dependent - Vendor: Danfoss / Copeland / Dixell - Products: Danfoss AK-SM and AK-SC (October CERT-FR scope), Copeland / Dixell XWEB (October CERT-FR scope) ## Technical overview CERT-FR first alerted on October 12 and revised its advice on October 16. It documents compromises involving Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controls. This record covers the operational incident pattern, not a newly disclosed vulnerability. EL PAÍS reports further disruption overnight before November 2 at Swedish ICA stores and more than 40 Delhaize locations in Belgium. The report does not establish a common attacker, CVE or controller model across the new cases. Loss estimates for the earlier French incidents must not be reused as a total for November. Exposure scale (October observations): ONYPHE’s October 13 study, updated October 15, identified 6,212 public IP addresses exposing Danfoss StoreView across 95 countries and territories over less than a week. Its October 22 study identified 1,960 XWEB EVO IP addresses across 65 countries using a seven-day scan cycle. These are historical observations of reachable interfaces, not counts of compromised stores, physical controllers or systems still exposed on November 2. The datasets must not be added into a unique-device total; exposure alone does not establish vulnerable firmware or involvement in these attacks. Copeland distinguishes unsupported XWEB EVO from its supported XWEB PRO platform; neither should have public management exposure. Recovery and replacement depend on the exact equipment. There is no universal fixed version for this incident record. Oktsec recommends a joint review by IT, refrigeration maintenance and store operations. Confirm which remote users can change settings, whether unexpected changes occurred and whether an independent temperature observation agrees with the controller. The linked Research article explains the control path and inventory decisions. Evidence of compromise elsewhere does not establish that the reader’s systems are affected. ## Recommended response Restrict remote administration, compare controller settings and alarm delivery with the approved baseline, and coordinate recovery with refrigeration operations. Relevant to: Retailers, cold-storage operators and refrigeration contractors with exposed controller administration or suspected unauthorized changes. The exact products in the November reports remain unverified. ## Response checklist 1. **Identify equipment and remote access owners** — Record each site, exact model, firmware, support status and contractor. Have the network owner verify the administration path. CERT-FR names product families in the October incidents; this is not a firmware-range list or proof of compromise at your site. 2. **Remove public administration exposure** — Coordinate access restrictions with operations and the service provider, preserving essential cooling and monitoring. Use an approved protected maintenance path. Do not confuse disconnecting public management access with switching off refrigeration. 3. **Verify settings, alarms and actual temperatures** — Compare setpoints, defrost schedules and alarm recipients with the approved baseline. Ask the refrigeration team to verify physical conditions and alert receipt. Escalate stock-handling decisions to the responsible food-safety team; a responsive dashboard is insufficient. 4. **Preserve evidence and follow model-specific recovery** — For suspected compromise, retain available access records and configuration evidence where safe. Use the vendor procedure with the technician. XWEB EVO is end of service; plan migration to a supported platform. A reset alone does not remove exposure or restore security support. ## Relevance to AI environments No AI involvement is established. Operational access and controller configuration are the relevant issues in this incident. ## Sources - [CERT-FR refrigeration-controller alert; guidance revised October 16](https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/) — CERT-FR / ANSSI; Government advisory; checked 2026-11-02T12:48:28Z - [Copeland/Dixell XWEB security and recovery bulletin, October 14](https://dixell.fr/wp-content/uploads/2026/10/Recommandations-pour-une-utilisation-securisee-des-superviseurs-XWEB-v1.0.pdf) — Copeland Controls / Dixell France; Vendor notice; checked 2026-11-02T12:48:28Z - [EL PAÍS: further European supermarket refrigeration incidents, November 2](https://elpais.com/tecnologia/2026-11-02/un-ciberataque-causa-perdidas-millonarias-en-decenas-de-supermercados-en-belgica-y-suecia.html) — EL PAÍS; Media report; checked 2026-11-02T12:48:28Z - [ONYPHE: Danfoss StoreView exposure, October 13; updated October 15](https://blog.onyphe.io/en/refrigeration-as-critical-infrastructure-analyzing-the-cyberattack-on-french-supermarkets/) — ONYPHE; Research report; checked 2026-11-02T13:04:52Z - [ONYPHE: Copeland/Dixell exposure study, October 22](https://blog.onyphe.io/en/refrigeration-as-critical-infrastructure-beyond-danfoss-the-exposure-of-copeland-dixell-supervisory-systems/) — ONYPHE; Research report; checked 2026-11-02T13:04:52Z ## Editorial record - 2026-11-02T12:48:28Z: Added the October CERT-FR incident scope and November 2 reporting, with exposed-access and operational recovery checks. No common CVE or attacker is established. - 2026-11-02T13:04:52Z: Added dated exposure measurements: 6,212 Danfoss StoreView IPs across 95 countries and territories and 1,960 XWEB EVO IPs across 65 countries. These are historical exposure observations, not victim counts or a live inventory. ## Related research - [legacy-controllers-cold-chain-attack](https://www.oktsec.com/research/legacy-controllers-cold-chain-attack) ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/refrigeration-controller-attacks-europe-2026) · [Build a response plan](https://www.oktsec.com/radar/refrigeration-controller-attacks-europe-2026#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=refrigeration-controller-attacks-europe-2026&service=exposure_check) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.