The Essentials
Three weeks after a first wave of sabotage targeting refrigeration facilities in France, new attacks have hit stores across seven European countries. The compromised systems shared the same weaknesses: administration interfaces accessible from the Internet and protected by default passwords.
- An extended campaign: chains were affected in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands, and Sweden.
- Targeted equipment: the Danfoss AK-SC and AK-SM controllers were again compromised. Copeland/Dixell systems had also been involved in the first wave.
- Known protections: CERT-FR and manufacturers advise removing direct exposure of management interfaces and favoring a protected network or a secure VPN.
- Remediation takes time: a software update is not always enough. Some installations require physical modifications and technician intervention, delaying their hardening.
After the sabotage operation on refrigeration installations in France’s large-scale retail sector, some stores took the necessary measures. Others did not, and paid the price.
Crude assessment from Danfoss in the wake of a new wave of attacks across Europe. Stores were affected in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands, and Sweden.
The October 11-12 offensive had compromised, among others, systems relying on Danfoss AK-SC and AK-SM controllers. These models were targeted again, the manufacturer acknowledges. But those actually taken over shared one trait: an internet-exposed management interface using the default password.
In the wake of the October attack, a flood of remedies…
Danfoss is not the only supplier involved in both incidents. Copeland/Dixell is involved as well. CERT-FR had mentioned both in its alert bulletin. « In general, exposing a management interface on the Internet is contrary to best practices », he commented. He suggested preferring a protected network or a secure VPN… after verifying the insurance terms in case of data upload interruptions to the refrigeration contractor.
In its own alert bulletin, Copeland/Dixell had also advised using an encrypted VPN. It proposed three solutions:
- A 4G router provided by them, equipped with a VPN and a SIM without a data plan
- The VPN server built into the Internet boxes (Free, Free Pro and Orange Pro offer it natively at no extra cost, it had noted)
- A dedicated VPN server (three providers cited: Teltonika, Stormshield, UniFi)
Dixell France recalled that the vulnerability exploited concerned an older generation of controllers (XWEB EVO), which reached end of maintenance in March 2026. It invited its customers to contact it to consider migrating to the XWEB PRO platform.
… not all easy to implement
Stephan Moelans is the CEO of Sacobel, a Belgian refrigeration systems installer. On-site, he counted about twenty affected installations. A software update is not enough, he notes: physical modifications are required. The simplest solution is to manage the equipment via a secure connection, he confirms. Those hacked were still awaiting that physical intervention.
According to Stephan Moelans, the same vulnerability was exploited as in the attacks in France. His counterpart at Kitman Coldtech – an Estonian installer – says nonetheless: “The signature is the same”… He counts one victim among his clients: the Selver group, in the “last branch” of the network that had not yet migrated to secure controllers.
From the assessments of the networks involved, many victims lie within affiliated networks. For Delhaize, for example, the Shop & Go convenience stores. Or for Colruyt, Spar stores, operated by autonomous operators. These networks have their own installation and maintenance contracts for refrigeration. In Sweden, Coop and ICA testify. The former explains that the affected equipment communicated via a 4G cellular connection not integrated into its central network. The latter mentions “independent remote management links.”
