The French National Agency for Information Systems Security (ANSSI) announced that the cyberattack that disrupted cooling systems in hundreds of supermarkets involved controllers from Copeland and its Dixell brand, in addition to Danfoss systems, which were the focus of the initial warning. According to French Finance Minister Roland Lescure, around 700 of the nearly 10,000 stores in the country were affected.
Scope of Affected Systems Expands
ANSSI’s Computer Emergency Response Center, CERT-FR, warned on October 12 of compromises affecting Danfoss AK-SM and AK-SC controllers. The following day, the center updated its alert to include Copeland XWEB and Dixell XWEB systems. Copeland later confirmed the existence of a vulnerability, saying it was working with affected customers to mitigate the risks.
During the summer, Claroty disclosed flaws in Danfoss AK-SM 800A, as well as 23 vulnerabilities in the Copeland XWEB Pro unit, and Copeland released a firmware update to address those flaws. However, CERT-FR, the French authorities, and Danfoss have not explicitly linked the current attacks to any of these vulnerabilities.
Old Devices and Operational Losses
Danfoss said most of the affected devices were older AK-SM 800 and AK-SC 355 units that had reached the end of their operational life and no longer received security updates. The company stopped supporting the AK-SM 800 in May 2021, while the AK-SC 355 was discontinued in 2016. Some newer AK-SM 800A units running older software versions were also affected.
The affected stores included the Carrefour, Coopérative U, E.Leclerc, Intermarché, and Monoprix chains. Les Mousquetaires, the owner of Intermarché, said around 150 stores were affected after the temperature of the cooling units reached 50 degrees Celsius for six hours, resulting in all the food inside them being discarded. Carrefour reported that 80 stores were affected, while Coopérative U said 80 stores were targeted, with fewer of them having to destroy products. Two stores in the Alsace region recorded combined losses of €270,000.
Reports said the attackers extended defrost cycles from one hour to eight hours, delaying alerts. The Paris public prosecutor’s office also referred to fires alongside food losses and opened an investigation through its cybercrime unit.
What Changes in Practice?
CERT-FR recommended that operators of the affected controllers disconnect them from the internet and not restore remote access except through a protected network or secure VPN. The agency considered restricting communications to IP addresses only a temporary emergency measure. For devices that had reached the end of their life, a factory reset would not be sufficient, as they would remain vulnerable if exposed to the internet again.
Censys identified nearly 3,000 Danfoss StoreView control panels exposed on the internet on October 11, including more than 1,800 in France. By October 14, the number in France had fallen to 537, while the number outside France remained close to its previous level. Updated and outdated versions disappeared at similar rates, suggesting that many operators disconnected the devices rather than updating them.
Questions Remain Open
No party has claimed responsibility for the attack, no ransom demand has appeared, and it remains unclear how the attackers gained access. Sekoia said stores in Spain, Portugal, Poland, Germany, and Belgium were also affected, without providing additional details. The incident also raises the question of responsibility for sensitive operational systems managed by vendors, as Les Mousquetaires said that the cooling systems were managed by Danfoss and that filing the complaint was the supplier’s responsibility.