Overnight on October 11, 2026, attackers compromised remote refrigeration controllers at supermarkets in France, according to Pen Test Partners’ incident analysis. CERT-FR’s alert, issued October 12 and updated October 13, named Copeland XWEB, Dixell XWEB, Danfoss AK-SC and Danfoss AK-SM systems among those affected.

FRANCE 24’s report shows empty food displays at an affected French supermarket and includes cybersecurity expert Marta Rybczynska discussing remote administration.

Ars Technica reported temperatures as high as 50°C, food spoilage and fires at some locations. The incident involved commercial refrigeration controls, not household refrigerators.

What the controller advisories cover

CERT-FR identified four equipment families in its alert. Separate advisories from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) describe vulnerabilities in specific Danfoss and Copeland models and software versions.

CISA’s Danfoss advisory, first published May 20, 2025, says Danfoss AK-SM 8xxA versions before R4.2 are affected by CVE-2025-41450, an authentication bypass tied to date- and time-based password generation. The advisory also lists CVE-2025-41451 and CVE-2025-41452 for versions before 4.3.1.

CISA’s Copeland advisory, published February 26, 2026, lists vulnerabilities affecting Copeland XWEB 300D PRO, XWEB 500D PRO and XWEB 500B PRO at version 1.12.1 or earlier. It says a fix is available and recommends updating. These advisories describe vulnerabilities in specified products and versions; they do not identify a CVE as the route into the French supermarkets.

How remote management could affect multiple cases

Commercial refrigeration systems can be managed remotely so operators can administer equipment without being on site. In the FRANCE 24 interview, cybersecurity expert Marta Rybczynska described that as a reason the systems were connected to the internet.

A system manager can coordinate multiple display-case controllers and push settings to them. In its technical reconstruction, Pen Test Partners says the manager could also disable alarms. The analysis describes how prolonged defrost-heater operation, combined with defeated termination safeguards, could drive temperatures above normal. Sustained heating could contribute to overheating where an electrical weak point exists.

That is a technical reconstruction of how the controls could be abused, not a site-by-site forensic account of the commands used or the cause of every reported fire.

CERT-FR’s recovery steps for compromised equipment

CERT-FR recommends this sequence for operators dealing with compromised controllers:

  1. Remove the equipment’s exposure to the public internet.
  2. Restore compromised equipment to factory settings.
  3. Reconfigure it and restore remote access only through a secure VPN or protected network.
  4. Apply the manufacturer’s security measures, including firmware updates and changing default passwords.

The alert also advises checking the full configuration, including defrost schedules. A factory reset alone is insufficient if an end-of-life controller remains vulnerable and exposed to the internet.