The recent cyberattack that disrupted refrigeration systems at numerous supermarkets in France has expanded to include equipment from Copeland and its Dixell brand. This information comes from ANSSI, France’s national cybersecurity agency, which has been closely monitoring the situation.
Initial Alert and Equipment Vulnerabilities
On October 12, ANSSI’s CERT-FR issued a warning about multiple compromises involving Danfoss AK-SM and AK-SC series controllers. The alert was updated the following day to cover vulnerabilities in Copeland’s XWEB and Dixell XWEB systems. Although Copeland initially hesitated to confirm these findings, the company has since recognized the vulnerabilities and is collaborating with affected customers to address the risk.
Earlier in the summer, security firm Claroty identified issues in Danfoss’s AK-SM 800A controller, along with 23 vulnerabilities in Copeland’s XWEB Pro device. Copeland has released a firmware update to address these security flaws.
Impact on Supermarkets and Response Measures
The attack has impacted around 700 of France’s approximately 10,000 supermarkets. Major chains such as Carrefour, Coopérative U, E.Leclerc, Intermarché, and Monoprix have reported disruptions. Finance Minister Roland Lescure informed lawmakers that this number is higher than previous estimates of 300 to 350 affected stores.
Some stores, like Intermarché, experienced severe temperature rises in refrigeration units, leading to significant food spoilage. Carrefour and Coopérative U also reported losses, with two stores in Alsace incurring damages totaling €270,000.
CERT-FR has recommended that operators disconnect affected devices from the internet and use secure VPNs or protected networks for remote access. A simple factory reset on compromised end-of-life devices is insufficient to ensure security.
Ongoing Investigation and Broader Impact
The Paris prosecutor’s office has launched an investigation into the cyberattack, noting that it caused fires in addition to food losses. Attackers reportedly extended defrost cycles, delaying alarms and worsening the impact. Despite the severity, there has been no claim of responsibility or ransom demand, puzzling investigators.
According to cybersecurity expert Félix Aimé from Sekoia, stores in Spain, Portugal, Poland, Germany, and Belgium have also been affected. However, there is no indication that a separate attack on Ahold Delhaize in the Netherlands is connected.
Further analysis by Censys revealed a notable decrease in internet-exposed Danfoss StoreView control panels in France, suggesting that operators are opting to disconnect rather than update their systems. This has sparked discussions about liability, with some affected companies urging suppliers to file complaints.
This incident highlights the critical need for robust cybersecurity measures in essential service sectors to prevent similar occurrences in the future.
