The cyberattack that disrupted refrigeration at hundreds of French supermarkets this week also affected equipment from Copeland and its Dixell brand, according to France’s national cybersecurity agency ANSSI.
ANSSI’s CERT-FR first warned on October 12 of numerous compromises involving Danfoss AK-SM and AK-SC series refrigeration controllers. A day later, the agency updated its alert to include Copeland XWEB and Dixell XWEB systems.
Copeland initially declined to confirm the agency’s findings, but it has since acknowledged a vulnerability. “We are currently working with impacted customers to mitigate the risk,” the company said.
This summer, Claroty detailed flaws in Danfoss’s AK-SM 800A, along with 23 vulnerabilities in Copeland’s XWEB Pro controller. Copeland patched them in a firmware update.
It is still unclear how the attackers gained access. The CERT-FR alert does not link the compromises to any specific vulnerability, and neither Danfoss nor French authorities have tied the attack to the flaws Claroty disclosed.
Danfoss said most of the affected devices are older AK-SM 800 and AK-SC 355 systems, which have reached end of life and are no longer patched. The vendor stopped supporting the AK-SM 800 in May 2021, and the AK-SC 355 was discontinued in 2016. Some current AK-SM 800A controllers that were running outdated firmware were also affected.
CERT-FR has urged operators of the affected controllers to take them off the internet and restore remote access only through a secure VPN or protected network. Filtering connections by IP address is acceptable only as a temporary emergency measure, the agency said.
For compromised end-of-life devices, a factory reset alone is not enough as the device will remain vulnerable and is likely to be compromised again if it stays exposed.