Six days after hackers remotely drove French supermarket refrigeration systems into meltdown, the controllers at the center of the story are still showing up on the open internet. Security researchers tracking the fallout say hundreds of Danfoss and Copeland refrigeration management units remain reachable from outside the networks they are supposed to protect, even as France’s cybercrime investigators dig into who pulled off the attack and how. The twist that is turning this into more than a one-off food-safety scare: industrial security firm Claroty says it flagged a serious flaw in the exact Danfoss controller line at the heart of the incident more than a year before the attack happened.
That gap between disclosure and exploitation is the real story behind the spoiled yogurt and shuttered freezer aisles. It is a familiar pattern in industrial control systems (ICS) security, but rarely does it play out somewhere as visible, and as relatable, as the supermarket down the street.
What Happened to French Supermarket Refrigeration Systems
Danfoss, the Danish industrial manufacturer whose refrigeration controllers run cooling systems in grocery stores, warehouses and food-processing plants across Europe, confirmed that attackers compromised a number of its refrigeration management systems in France. The company said it was “aware of incidents in France affecting a limited number of refrigeration management systems,” and separately said the affected units “were running outdated firmware” that no longer received software or security updates.
France’s national cybersecurity agency went further, saying it was “aware of numerous compromises” tied to refrigeration remote-control modules made by both Danfoss and Copeland, the US-based rival that also supplies supermarket cooling controls. The specialized cybercrime unit inside the Paris prosecutor’s office has opened a formal investigation, according to AP News, which reported the cyberattack hit roughly 700 supermarkets across the country, a figure shattered.io covered in detail as the store toll climbed. German broadcaster DW described the toll more conservatively as hundreds of stores, reflecting how fluid the numbers remain as the investigation continues.
What is not in dispute is the mechanism. Attackers got remote access to refrigeration management platforms and altered operational settings, including defrost cycles and temperature limits, according to multiple reports reviewed for this story. The precise exploit chain used in the French incident has not been confirmed by Danfoss, Copeland or French authorities, and the identity of the attackers remains unknown.
The Danfoss Products Named in the Reports
Three Danfoss product names keep surfacing in coverage of the incident: the AK-SM800 and AK-SM 800A supervisory controllers, and the AK-SC355 controller, part of the AK-SC series used to manage and monitor commercial refrigeration equipment. These are the systems installed inside a supermarket’s back room that give a store, or a remote facilities team, central control over every cooling unit on the sales floor and in cold storage.
That centralization is exactly what makes the controllers attractive to attackers and useful to legitimate operators at the same time. Claroty’s industrial security research unit, Team82, has said that because these systems provide centralized management of refrigeration equipment, compromising the management interface can have significant operational consequences. One compromised login, in other words, can touch every freezer in a store, or every store on a network, depending on how the system is configured.
Copeland’s XWeb Pro platform, which performs a similar monitoring and control role for its refrigeration customers, was also named by Claroty in vulnerability research covering both manufacturers’ systems. Beyond confirming the vulnerability research exists and names both platforms, the exact technical details of each flaw have not been fully disclosed publicly.
Claroty’s Warning Came More Than a Year Before the Attack
The detail that separates this story from a routine industrial hack is the timeline. Amir Preminger, chief technology officer and head of Team82 at Claroty, said his team had already flagged the core problem long before French supermarkets started losing refrigerated stock. “We disclosed, to Danfoss, more than a year ago, a vulnerability that actually enables an attacker to bypass the authentication,” Preminger said, in remarks reported by India Today.
Danfoss did not ignore the report. “Danfoss fixed and released it,” Preminger said of the company’s response to Claroty’s disclosure. That is, on paper, the vulnerability-disclosure process working the way it is supposed to: a security vendor finds a flaw, reports it privately, and the manufacturer ships a fix. Where the process broke down was everything downstream of the patch release. A fix sitting on a vendor’s download page does nothing for a supermarket chain running a controller nobody has updated in years, often because the specific hardware generation is no longer supported at all.
Danfoss’s own public response leaned into that distinction. “We acknowledge the vulnerability identified in a discontinued, end-of-life generation of controllers,” the company said, adding that “protecting our customers’ operations has always been a top priority,” according to reporting from The Register. The framing matters for how blame gets assigned: a patched vulnerability in a current product is a very different failure mode than an unpatchable flaw baked into hardware that is still running in thousands of stores because nobody budgeted to rip it out.
Why End-of-Life Hardware Keeps Showing Up in ICS Incidents
Refrigeration controllers are not laptops. A supermarket chain does not swap out a cooling management system on a two- or three-year refresh cycle the way an IT department replaces endpoints. Industrial and building-management hardware routinely stays in service for a decade or more, long after a vendor stops shipping firmware updates for it. That mismatch between hardware lifespan and software support lifespan is the single biggest reason OT and ICS environments keep surfacing in attacks years after the underlying flaw was first reported.
Why Systems Stayed Exposed Even After the Attack Made Headlines
Perhaps the most unsettling part of this story is what happened after the attack became public. Internet-scanning research cited in coverage of the incident found that refrigeration management interfaces, the exact class of system implicated in the French attack, were still reachable from the open internet days later. Industry reporting described thousands of exposed administration panels tied to Danfoss’s StoreView product being detected in scans conducted in the weeks around the attack, with a majority of the flagged addresses traced to French networks. Separate scanning data referenced in trade press coverage described the count of exposed Danfoss AK-SM 800A instances easing somewhat in the days immediately following the attack, alongside a separate tally of more than a thousand internet-facing Copeland XWeb instances, though neither figure has been independently confirmed by Danfoss, Copeland or French authorities, and this publication is treating the precise counts as unconfirmed.
What that pattern illustrates, regardless of the exact numbers, is a structural problem rather than a single bad decision. An admin panel for a refrigeration controller should not be reachable from the public internet at all in a well-segmented network. When thousands of them are, an attacker does not need a zero-day. They need a search engine for exposed devices and a known authentication-bypass technique, the same combination that security researchers have warned about across the broader category of internet-exposed industrial control systems for years, a theme shattered.io explored in its look at the firmware gaps behind the six-hour thaw cycle.
Operational Fallout: Spoiled Stock and Store-Level Disruption
For store managers, the technical root cause mattered less than the immediate result: refrigeration settings changed remotely, defrost cycles disrupted, and product loss across refrigerated and frozen categories. Reports describe the operational impact as attackers remotely altering refrigeration settings, including defrost cycles, in a way that caused food spoilage across affected locations. Specific claims that temperatures were pushed as high as 50 degrees Celsius, or that frozen sections were driven to extreme highs, have circulated in some reporting but have not been confirmed by Danfoss or French authorities in material reviewed for this story, so they are treated here as unconfirmed rather than established fact.
What is confirmed is the scale of concern from French authorities, who described the compromises as numerous enough to warrant a national cybersecurity response, and the involvement of the Paris prosecutor’s dedicated cybercrime unit, which does not open investigations into minor or isolated incidents. Reports have floated the names of major French retail chains as potentially affected, but no retailer has been officially confirmed as a victim by Danfoss, Copeland or French authorities in the sourcing available for this piece, and this article is not naming any specific retail chain as a confirmed victim. shattered.io’s initial coverage of the attack tracked the earliest reports as the scale of the incident first became clear.
Danfoss and Copeland Product Lines Named in Reporting
| Product | Manufacturer | Role | Status Reported |
|---|---|---|---|
| AK-SM800 / AK-SM 800A | Danfoss | Supervisory refrigeration controller | Named in attack reporting; older units reportedly unsupported |
| AK-SC355 | Danfoss | Refrigeration case/system controller (AK-SC series) | Named in attack reporting |
| StoreView | Danfoss | Remote monitoring/administration panel | Flagged in exposure-scanning coverage |
| XWeb Pro | Copeland | Refrigeration monitoring and control platform | Named in Claroty vulnerability research |
| Dixell XWeb | Copeland (Dixell) | Refrigeration monitoring platform | Referenced in incident coverage |
The common thread across every product in that list is centralized remote management. Each one exists specifically so a facilities team, or a third-party service provider, can see and adjust refrigeration settings without physically visiting a store. That design goal, remote control at scale, is precisely the feature attackers turned against the operators who rely on it.
How This Compares to Past ICS Disclosure-to-Exploit Gaps
Industrial control systems security has a long history of vulnerabilities sitting unpatched in the field for years after disclosure, simply because the hardware running them is expensive or disruptive to replace. The Triton/Trisis malware that targeted Schneider Electric safety controllers in 2017 exploited systems that had been deployed, and left largely unmonitored, for years. The Stuxnet worm, which targeted industrial controllers more than a decade earlier, demonstrated how physical processes, not just data, could be the target of a cyberattack. Water utility intrusions in the United States in recent years have repeatedly involved internet-exposed operational technology that was never meant to be internet-facing in the first place.
The Danfoss and Copeland case fits that pattern closely, with one meaningful twist: refrigeration is not a power plant or a water treatment facility. It is retail infrastructure that touches ordinary grocery shopping, which is likely why this incident has drawn far more mainstream news coverage than most ICS disclosures ever do. CNET and BleepingComputer both covered the story for general technology audiences, not just the usual industrial-security trade press, which is itself a signal of how far this incident has traveled beyond its original OT security niche.
Timeline: From Disclosure to Headline
| Stage | What Happened | Source |
|---|---|---|
| More than a year before the attack | Claroty privately discloses an authentication-bypass vulnerability in Danfoss refrigeration controllers | Claroty (Amir Preminger) |
| Following disclosure | Danfoss develops and releases a fix for the reported flaw | Claroty (Amir Preminger) |
| Ongoing, prior to the attack | Older, unsupported controller generations remain in the field without the fix applied | Danfoss statement |
| Attack window, October 2026 | Attackers compromise refrigeration management systems at French supermarkets | French cybersecurity agency; AP News |
| Days after the attack | Paris prosecutor’s cybercrime unit opens formal investigation | AP News |
| Following week | Exposed refrigeration admin panels and controllers still detected on the open internet | Industry security reporting |
Danfoss and Copeland’s Public Response
Both manufacturers have responded publicly, and both responses lean on a similar argument: the vulnerability exists primarily in discontinued or unsupported hardware generations, not in currently sold and supported products. Danfoss’s statement describing the affected units as “a discontinued, end-of-life generation of controllers” is consistent with its separate confirmation that most affected French systems were older products no longer receiving software or security updates.
Copeland has acknowledged vulnerabilities tied to its own discontinued, end-of-life controllers as well, and said it is working with customers to reduce risk, according to reporting reviewed for this story. Neither company has published a full technical breakdown of the exploit chain used in the French attack, and neither has confirmed a specific financial loss figure. Early damage estimates circulating in regional reporting reference losses in the millions of euros, but no official total has been published by either manufacturer or by French authorities as of October 17.
What Security Researchers Are Saying
The expert reaction to this incident has focused less on the attackers’ sophistication and more on the predictability of the outcome. Claroty’s Team82 research team has repeatedly made the point that centralized refrigeration management interfaces carry outsized operational risk precisely because of what they control. “Because these systems provide centralized management of refrigeration equipment, compromising the management interface can have significant operational consequences,” the team said, in comments reported by SecurityWeek.
Preminger’s account of the disclosure timeline, delivered after the attack rather than before it, underscores a recurring frustration among ICS security researchers: responsible disclosure can produce a patch, and a patch can still fail to protect anyone if the affected hardware is never updated in practice. “We disclosed, to Danfoss, more than a year ago, a vulnerability that actually enables an attacker to bypass the authentication,” he said, before noting that Danfoss did ship a fix. The gap between those two facts, a real fix existing and a real attack still succeeding, is the throughline of this entire story.
Danfoss, for its part, has tried to reassure customers without overpromising. “Protecting our customers’ operations has always been a top priority,” the company said, while simultaneously confirming that the hardware generation involved is no longer supported, a combination of messages that is likely to invite scrutiny from retail customers over whether replacement timelines for legacy refrigeration controllers need to move faster than they currently do.
Market and Industry Impact
Danfoss and Copeland both sit in a corner of the industrial technology market that rarely makes consumer news: building and refrigeration management systems. That obscurity is ending fast. Retail chains across Europe and, by extension, grocery operators in other regions running similar refrigeration management platforms, now have a concrete, publicly documented incident to point to when budgeting for OT security upgrades, something that has historically been a hard sell against competing capital priorities like store remodels or point-of-sale upgrades. shattered.io previously examined how exposed systems could put US grocers at similar risk, and looked separately at how the incident is reshaping cold-chain insurance underwriting in Australia.
Cyber insurers are likely to take note as well. An incident involving confirmed physical consequences, spoiled inventory and potential fire risk, rather than just stolen data, sits in a different risk category than a typical data breach, and insurers that write policies covering retail and food-supply operations will likely revisit how they underwrite OT and refrigeration exposure going forward. For vendors like Danfoss and Copeland, the reputational cost of being named in connection with a national cybersecurity incident, even one rooted in customer-side patching failures rather than a current-product flaw, is not something either company can fully control through public statements alone.
Competitive Comparison: How Vendor Responses Differ
| Factor | Danfoss | Copeland |
|---|---|---|
| Products named in reporting | AK-SM800, AK-SM 800A, AK-SC355, StoreView | XWeb Pro, Dixell XWeb |
| Vulnerability status | Fix released after Claroty disclosure; issue tied to end-of-life hardware still in the field | Acknowledged vulnerability in discontinued, end-of-life controllers |
| Public statement tone | Confirms limited scope; emphasizes outdated firmware on affected units | Acknowledges vulnerability; says it is working with customers on risk reduction |
| Named in French attack coverage | Yes, primary focus of initial reporting | Yes, named by French cybersecurity agency alongside Danfoss |
Neither company has a materially different story here. Both built capable remote-management products, both had flaws identified by outside researchers, and both now have customers running old hardware that never got the fix. The competitive differentiator, if there is one, will come down to which company moves faster on customer outreach, firmware migration incentives, and possibly subsidized hardware replacement programs over the next several months.
Historical Context: Food Retail Meets Industrial Security
Retail refrigeration has never been treated with the same security rigor as power grids, water systems, or manufacturing floors, largely because the worst-case outcome was always assumed to be spoiled stock rather than a safety incident. This attack complicates that assumption. Reports describing fire risk at some affected locations, tied to equipment running outside its designed operating parameters, move refrigeration security closer to the same risk category as other critical operational technology, where a cyberattack can produce physical, not just financial, consequences.
That shift matters for how regulators think about the sector going forward. Food retail has not historically been classified alongside energy, water, and healthcare as critical infrastructure requiring mandatory OT security baselines in most jurisdictions. An incident large enough to draw a formal criminal investigation from a national cybercrime unit, as this one has in France, is the kind of event that tends to accelerate those regulatory conversations rather than waiting for the next one.
What Happens Next: Five Predictions
- French authorities will likely publish more specific figures on affected store counts and financial losses as the Paris prosecutor’s cybercrime investigation progresses, replacing today’s range of conflicting estimates with an official total.
- Danfoss and Copeland will likely face pressure from major retail chains to offer accelerated replacement or firmware-upgrade programs for end-of-life refrigeration controllers still deployed across Europe.
- Expect other European and North American grocery chains to run internal exposure audits on their own Danfoss, Copeland, and similarly positioned refrigeration management systems in the coming weeks, prompted directly by this incident rather than by a prior internal mandate.
- Regulators overseeing food-retail infrastructure will likely face renewed calls to extend OT security requirements, similar to those already applied to energy and water utilities, into commercial refrigeration and cold-chain management.
- Expect additional vulnerability disclosures tied to other refrigeration and building-management vendors in the months ahead, as researchers and journalists now have an incentive to scrutinize a product category that previously drew little attention.
Lessons for Retailers Running Industrial Control Systems
For IT and operational technology teams outside France reading this story, the practical takeaway is less about Danfoss or Copeland specifically and more about asset inventory. Most organizations running refrigeration, HVAC, or similar building-management controllers cannot say with confidence exactly which firmware versions are deployed across every location, let alone which of those versions still receive vendor security updates. That blind spot, not any single software flaw, is what let a disclosed and patched vulnerability remain exploitable more than a year after the fix shipped.
Segmentation is the other obvious gap. A refrigeration controller’s administrative interface should never need to be reachable directly from the public internet. Every scan that turns up thousands of exposed building-management panels represents a network architecture decision, somewhere, that put convenience ahead of isolation. Fixing that does not require a new product or a security vendor contract. It requires someone auditing firewall rules and remote-access configurations store by store, which is unglamorous work that rarely gets funded until an incident like this one makes the case for it. For teams prioritizing which exposures to fix first, shattered.io’s comparison of CVSS scoring against the CISA known-exploited-vulnerabilities catalog is a useful starting framework.
Frequently Asked Questions
What caused the French supermarket refrigeration cyberattack?
Attackers remotely accessed refrigeration management systems made by Danfoss and Copeland and altered operational settings, including defrost cycles, according to France’s national cybersecurity agency and multiple news reports. The exact exploit chain has not been publicly confirmed.
Which Danfoss products were named in the attack?
Reports name the AK-SM800 and AK-SM 800A supervisory controllers, the AK-SC355 controller, and the StoreView remote monitoring panel.
Did Claroty really warn Danfoss before the attack happened?
Yes. Claroty’s Amir Preminger said his team disclosed an authentication-bypass vulnerability to Danfoss more than a year before the French attack, and that Danfoss fixed and released a patch at the time.
Why didn’t the Claroty-disclosed patch prevent the attack?
Danfoss says the affected units in France were running older, unsupported firmware that never received the fix, because the specific hardware generation involved is discontinued and no longer updated.
How many stores were affected?
Estimates vary by outlet. AP News reported the cyberattack hit roughly 700 supermarkets, while other coverage describes the toll more generally as hundreds of stores. No official, confirmed total has been published by French authorities as of October 17, 2026.
Is Copeland also affected, or just Danfoss?
France’s national cybersecurity agency said it was aware of numerous compromises involving refrigeration remote-control modules from both Danfoss and Copeland, including Copeland’s XWeb Pro platform and its Dixell XWeb product line.
Are refrigeration controllers still exposed to the internet after the attack?
Security researchers have reported continued internet exposure of refrigeration management interfaces in the days following the attack, though exact device counts vary across sources and have not been independently confirmed by the manufacturers.
What should other retailers do in response to this incident?
Security researchers recommend auditing which refrigeration and building-management controllers are internet-facing, confirming which firmware versions are still supported by the vendor, and removing direct public internet access to administrative interfaces in favor of segmented, authenticated remote-access methods.