France's national computer emergency response team widened its alert on hijacked supermarket refrigeration Tuesday to cover controllers from Copeland and Dixell as well as Danfoss, warning that attack campaigns are probably still under way. Reuters reported that at least 350 French supermarkets have been affected and that no group has claimed responsibility or demanded a ransom. The update turns a French retail incident into an exposure question for any food retailer or cold-storage operator whose refrigeration controls can be reached from the internet, including in the U.S.

The attack first forced chains to throw out chilled and frozen food Monday.

What Happened

The alert from CERT-FR, part of France's national cybersecurity agency ANSSI, was first issued Oct. 12. It says the agency knows of numerous compromises of remote controllers for refrigeration systems. Its Oct. 13 revision added equipment, and the list now covers Danfoss AK-SM and AK-SC series devices plus Copeland xweb and Dixell xweb. The alert names no software flaws and does not say how the devices were taken over.

RelatedCyberattack on Store Refrigeration Forces French Supermarkets to Throw Out Chilled Food

Reuters counted at least 350 affected stores across groups including Carrefour, Monoprix, Intermarché and Coopérative U, a small fraction of French supermarkets. Carrefour put its own count at 80 stores, and Les Mousquetaires said fridges at about 150 Intermarché stores were heated to 50°C (122°F) for six hours overnight, Reuters reported Monday. Intermarché Chief Executive Thierry Cotillard told BFM TV that losses could reach tens of millions of euros nationwide in a single day. No industry-wide figure exists.

Prime Minister Sébastien Lecornu ordered ANSSI to investigate, and a source close to him told Reuters the agency had found a vulnerability in software supplied by Danfoss. The Danish company said many affected units had "reached end of life" and no longer received security updates, or ran outdated firmware, and that it had long urged customers to update. It declined further comment Tuesday. A source close to the investigation told Reuters that investigators were puzzled by the lack of any claim or ransom demand.

Felix Aimé, an analyst at French security firm Sekoia, told Reuters that Spain, Portugal, Poland, Germany and Belgium were also hit. No government has confirmed that.

Why It Matters

The exposure is wide. Using Shodan, a search engine that indexes internet-connected devices, Reuters found at least 4,500 Danfoss interfaces visible online Tuesday. Internet scanning company Onyphe told Reuters that outdated, vulnerable versions remain common among them. Predicta Lab counted 2,752 exposed Danfoss systems Monday, 1,590 of them in France, BleepingComputer reported.

The weaknesses are not new. Security firm Claroty published research Aug. 9 on flaws in Danfoss's AK-SM 800A system manager, including a hidden daily code that could bypass the administrator password. Danfoss has fixed them in newer software. In February, the Cybersecurity and Infrastructure Security Agency (CISA) published an advisory on 23 flaws in U.S.-based Copeland's XWEB Pro controllers, including a maximum-severity login bypass. Neither CERT-FR nor any company has said whether these flaws were used.

Reuters also noted that about a dozen U.S. military commissaries suffered similar refrigeration disruptions and food losses in late August. No link between the incidents has been established.

For executives, the lesson is about supplier access to operational technology, the systems that control physical equipment. Refrigeration contractors often manage these controllers remotely, and three cyber experts told Reuters the attack looked easy to carry out. CERT-FR's advice is concrete. Operators should take affected units off the internet, check defrost schedules, allow access only through a secure VPN, apply firmware updates and change default passwords. Compromised units must be reset and reconfigured, since a reset alone leaves them open to reinfection. CERT-FR also tells operators to check insurance terms before cutting data feeds to refrigeration contractors.

What to Watch

Watch whether investigators identify the attackers and the method, and whether Danfoss, Copeland or CISA issue guidance for customers outside France. Other European governments may confirm cases. The Paris prosecutor's investigation, final loss totals and how insurers treat them will shape who pays.