Researchers warned attackers could 'defrost the food' months before French supermarkets got hit

1. Executive summary

Unknown attackers compromised thousands of internet-exposed refrigeration controllers across nearly 700 French supermarkets late on Sunday 11 October 2026, raising setpoints as high as 50°C (122°F), spoiling food and starting fires. ANSSI attributed the compromises to Danfoss controllers on Monday and extended the warning to Copeland and its Dixell brand the following day. The affected devices are end-of-life or outdated-firmware units with web-accessible admin panels, and Coalition scanning found 1,506 Danfoss StoreView panels still exposed between 7 September and 6 October, 54 percent of them on French networks. No CVE, CVSS score, or CISA KEV entry is resolved for this item in our reference data, so severity here is assessed from operational impact rather than a scored vulnerability. For EMEA financial services the direct exposure is low, but the same class of internet-facing building and facilities controllers sits in branch estates, data-centre halls, and third-party colocation, and the incident is a live test of whether those devices are in scope for DORA third-party and incident-reporting processes.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 28: ICT third-party risk, general principles	Compromised controllers were end-of-life Danfoss and Copeland/Dixell units, and Copeland states it is "working with impacted customers to mitigate the risk" on a discontinued product line	Firms running these controllers through a facilities or refrigeration contractor must establish whether the contract covers end-of-life hardware, who patches it, and who notifies whom. A vendor that has stopped supporting the product line is a contractual gap, not just a technical one.
DORA Art. 17: ICT-related incident management process	The compromise vector was an internet-reachable admin panel on an OT device, a class of asset that frequently sits outside the ICT incident process	If a firm holds any of these controllers, the incident process must be able to detect and classify an OT-side event, not only IT-side. Confirm the process names OT assets and the responsible team.
NIS2 Art. 21(2)(d): supply chain security measures	The affected hardware reaches clients through refrigeration and facilities suppliers, not through the firm's own IT procurement	Entities in scope must be able to evidence supply chain security measures over subcontractors that install and maintain internet-connected OT. Ask the contractor for the device inventory and its exposure status.

No DORA Art. 19 or NIS2 Art. 23 reporting obligation is engaged for a firm that holds none of these devices; those articles turn on the firm itself suffering a major incident, which is not established here.

3. Technical analysis & attack chain

The attack is confirmed at the level of outcome and target class. The precise initial-access technique is not stated in the source material, and we do not infer one.

Attackers reached refrigeration controllers that were directly reachable over the internet. ANSSI's warning describes widespread compromises of Danfoss controllers, and the reporting states the compromised devices were accessible over the internet.
The controllers were manipulated to raise temperature. Reporting puts the setpoint change as high as 50°C (122°F).
The temperature change caused physical consequences: food spoilage and fires across nearly 700 French supermarkets.
ANSSI issued a warning on Monday 12 October covering Danfoss controllers, then extended it a day later to Copeland and its Dixell brand.

The vulnerable device classes are Danfoss AK-SM 800A and Copeland XWEB controllers, with CISA advisories also covering the Danfoss AK-SM 8xxA series and Copeland XWEB and XWEB Pro. Claroty's Team82 published research in August 2026 describing dozens of vulnerabilities in these products, including authentication bypass and operating-system command execution flaws, and framed the impact in operational terms: an attacker could "freeze the controller" and "defrost the food." CISA's February advisory on Copeland XWEB and XWEB Pro described nearly two dozen CVEs that could "allow an attacker to bypass authentication, cause a denial-of-service condition, cause memory corruption, and execute arbitrary code." A May 2025 CISA advisory, updated in August 2025, covered the Danfoss AK-SM 8xxA series.

Danfoss released firmware update R4.3.1 to mitigate the flaws. The French attacks occurred roughly two months after Team82 published its research and after that firmware was available. Coalition's Tiago Henriques said the firm's scanning found critical exposure continuing into the autumn despite patch availability. Between 7 September and 6 October, Coalition sensors identified 1,506 unique IP addresses still publicly exposing a Danfoss StoreView web-accessible admin panel, 820 of them (54 percent) on French networks. Coalition counted at least 2,624 refrigeration controllers from the named brands with a login page open to the internet: 1,506 Danfoss StoreView and 1,119 XWEB, with one IP running both types. As of Thursday 15 October, 618 Danfoss devices remained internet-connected, 206 on French networks, 50 in the US, and two in the UK.

Two caveats on that exposure data. First, an exposed login page does not mean the device was vulnerable or compromised; it means the admin interface was reachable. Second, the exposure counts are single-sourced to Coalition's scanning and are not corroborated by a second telemetry provider in the material we hold. Treat the figures as indicative of scale, not as a verified census.

Attribution is unconfirmed. The reporting describes "unknown criminals" and names no actor. No MITRE ATT&CK profile is available for any actor in this item, and we make no attribution.

4. Mitigation & containment

P1 (within 24 hours)

Establish whether your estate, or any facilities or refrigeration contractor acting for you, runs Danfoss AK-SM 800A, Danfoss AK-SM 8xxA series, Copeland XWEB, Copeland XWEB Pro, or Dixell controllers. If the answer is unknown, that is the finding.
For any such controller reachable from the internet, remove the exposure. Block inbound access to the controller's web admin interface at the perimeter firewall, or take the management interface off the public internet entirely. Coalition's scan data shows the Danfoss StoreView admin panel and the XWEB login page are the reachable surfaces.
Where a controller is confirmed compromised or behaving abnormally, isolate it from the network and revert setpoints under physical supervision before restoring normal operation. Do not re-enable remote access to restore service.
Apply Danfoss firmware R4.3.1 where the hardware is a supported Danfoss AK-SM unit. For Copeland and Dixell units, Copeland's statement covers only a "discontinued, end-of-life generation of controllers" and gives no firmware fix; treat replacement or network isolation as the control.

P2 (within 72 hours)

Inventory every internet-facing OT and building-management device in the estate, not only refrigeration. The failure mode here is a web-accessible admin panel on a device nobody classified as ICT.
Put the refrigeration and facilities contractor on notice in writing: request the device list, firmware versions, and confirmation that no management interface is internet-reachable. Record the response against your DORA Art. 28 third-party file.
Add the controllers to vulnerability management scope so that future advisories on these product lines reach the team that owns the devices.

P3 (within 7 days)

Review the contract with the facilities provider for end-of-life hardware. Copeland's own statement is that the affected generation is discontinued; a product line with no vendor support needs a replacement plan with dates, not a patching expectation.
Confirm the ICT incident process can classify an OT-side event and that the on-call path reaches whoever owns the refrigeration estate out of hours. The French attacks occurred late on a Sunday night.

5. Indicators of compromise

No atomic indicators of compromise are available in the source material. No file hashes, domains, IP addresses, or filenames are given. The exposure data in §3 is a count of internet-reachable admin panels, not a list of malicious infrastructure, and we will not reproduce it as IOCs.

The sources do describe observable conditions. These are behavioural indicators and belong in the table below, not in a machine-pivotable block.

Behavioural indicators

behaviour	where to observe	confidence
Refrigeration controller web admin panel (Danfoss StoreView) reachable from the internet	External attack-surface scan of the estate and contractor-managed sites; perimeter firewall logs for inbound sessions to controller management ports	High that this is the exposure class; the specific panel name is single-sourced to Coalition
Copeland XWEB or XWEB Pro login page reachable from the internet	Same as above	High that this is the exposure class; single-sourced to Coalition for the count
Controller setpoint changed to an abnormally high value without a maintenance work order	Controller configuration history, BMS/SCADA setpoint change logs, refrigeration alarm history	High; the 50°C figure is reported, the logging source is not specified
Controller running outdated firmware or an end-of-life model with no vendor update path	Asset inventory cross-referenced against Danfoss and Copeland support status	High

6. Detection

The sources give no file artefacts, command lines, mutexes, registry keys, or filenames from the malicious activity itself. The named products, CVE counts, and vendor statements are reporting about the incident, not artefacts of it, so a YARA rule built from them would match the reporting rather than the threat. We decline to emit one.

Detection effort is better spent on the exposure and setpoint-change conditions in §5. A Sigma rule for the setpoint-change case is below; it assumes controller or BMS events are forwarded to a log platform, which is itself worth confirming.

title: Refrigeration Controller Setpoint Raised To Abnormal High Value
id: 6f1c2a94-3d7e-4b21-9a55-0c7e5b8d1f30
status: experimental
description: Detects a refrigeration or BMS controller setpoint change to an abnormally high value, the manipulation reported in the October 2026 French supermarket compromises.
author: Adverse Trace
date: 2026/10/15
references:

  - https://www.theregister.com/security/2026/10/15/researchers-warned-attackers-could-defrost-the-food-months-before-french-supermarkets-got-hit/5303425
logsource:
  category: process_creation
  product: windows
detection:
  selection_event:
    EventID: 4688
  selection_terms:
    CommandLine|contains:

      - 'setpoint'
      - 'StoreView'
      - 'XWEB'
  selection_value:
    CommandLine|re: '(4[5-9]|50)(\.\d+)?\s*(C|Celsius)'
  condition: selection_event and selection_terms and selection_value
falsepositives:

  - Legitimate defrost cycles and maintenance setpoint changes
  - Commissioning and engineering work on refrigeration plant
level: high

This rule is a starting point, not a tuned control. The command-line terms are drawn from product names in the reporting and will need narrowing against your own controller and BMS telemetry before it is enabled. If controller events are not centralised, the higher-value action is to get setpoint-change events into the log platform.

7. Sources

The Register, "Researchers warned attackers could 'defrost the food' months before French supermarkets got hit", https://www.theregister.com/security/2026/10/15/researchers-warned-attackers-could-defrost-the-food-months-before-french-supermarkets-got-hit/5303425, 15 October 2026.

This is the only source supplied for this item. Every fact in this advisory traces to it, including the ANSSI warnings, the Claroty Team82 research, the CISA advisories, the Danfoss R4.3.1 firmware, the Copeland statement, and the Coalition exposure figures. We have not independently retrieved the ANSSI, CISA, Claroty, or Coalition publications, and clients should treat the exposure counts and the firmware version as single-sourced until confirmed against those primary documents.

8. Adverse Trace position

We assess this as a high-impact OT incident with low direct exposure for most EMEA financial services clients, and we are not raising a sector-wide alert on it. The affected asset class is refrigeration control, and the firms holding those devices are retailers and their facilities contractors. The reason this advisory goes to financial services clients is the pattern rather than the target: an end-of-life controller with a web admin panel, reachable from the internet, sitting under a facilities contract rather than an IT one, and therefore outside the asset inventory, the vulnerability process, and the incident process. That pattern is present in branch estates, data-centre mechanical plant, and colocation. We will attempt to retrieve the ANSSI advisory, the CISA advisories, and the Claroty Team82 research to confirm the affected model list and the firmware version, and we will issue a follow-up if the affected device set is wider than the Danfoss AK-SM 800A, AK-SM 8xxA, Copeland XWEB, and XWEB Pro families named here. Clients who want the exposure check run against their own estate or their contractor's should contact their Adverse Trace account lead.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.