France’s refrigeration-system cyberattack affected roughly 700 supermarkets and independent stores, with authorities expanding their warning to include Copeland XWEB and Dixell XWEB controllers alongside Danfoss equipment. France’s national cybersecurity agency, ANSSI, first reported numerous compromises of Danfoss AK-SM and AK-SC systems on October 12, then added the Copeland and Dixell platforms the following day. No threat group has claimed responsibility, and investigators have not publicly established the attackers’ entry point.
Finance Minister Roland Lescure told lawmakers that about 700 of France’s approximately 10,000 supermarkets were affected. Attackers remotely altered refrigeration settings during the night of October 11-12, reportedly raising temperatures high enough to spoil perishable goods and, in some cases, contribute to fires. The Paris prosecutor’s office opened an investigation, while the government said the incident did not threaten national food supplies. Retailers in several other European countries also reported disruption, although the largest confirmed impact was in France. The Associated Press reported that authorities had not attributed the operation to a known actor.
The incident follows public research showing that internet-exposed refrigeration-management systems can provide a direct route into operational technology. Claroty’s Team82 identified multiple weaknesses in the Danfoss AK-SM 800A and Copeland XWEB Pro platforms, including authentication and command-execution issues. Claroty said it found thousands of Danfoss systems exposed to the public internet, but neither ANSSI nor the vendors have confirmed that the newly reported attacks used those specific flaws. Claroty’s analysis said the research demonstrated how compromise of supervisory controllers could let an attacker manipulate refrigeration infrastructure.
For Danfoss AK-SM 8xxA systems, the vendor advisory assigns CVE-2025-41450 a CVSS score of 8.2 and says versions before 4.2 are affected. Danfoss separately tracks CVE-2025-41451, a post-authentication command-injection flaw that can enable remote code execution, and CVE-2025-41452, an Nginx-configuration injection issue; its advisory recommends version 4.3.1 or later. The NVD entry for CVE-2025-41451 describes the affected range as versions earlier than 4.3.1. These records establish serious technical exposure, not confirmed exploitation in the French incident.
Danfoss says many affected AK-SM 800 and AK-SC 355 units are older, end-of-life products that no longer receive security updates. Copeland’s XWEB Pro security bulletin says firmware 1.13 addresses previously identified vulnerabilities and advises operators never to expose the controller’s web interface directly to the internet. Operators should inventory Danfoss, Copeland and Dixell systems, isolate management interfaces behind firewalls or VPNs, remove public exposure, change default credentials, apply supported firmware and monitor controller logs for unauthorized temperature or configuration changes. Where equipment is beyond support, replacement or compensating network controls may be the only sustainable mitigation.
