Supermarket hacking spree hits second refrigeration supplier

01 Hackers disrupted refrigeration systems at French supermarkets, spoiling food and raising safety concerns.

02 An E.Leclerc store using Dixell/ Copeland equipment suffered a failure after earlier Danfoss-linked attacks.

03 Researchers say many refrigeration controllers are exposed online, including nearly 2,900 Danfoss systems in France.

04 Police and France’s cybersecurity agency are investigating, but there is no proof which flaws attackers used.

Key Takeaways by nexos.ai , reviewed by Cybernews staff.

Cyberattacks that knocked out fridges and spoiled food across French supermarkets may have spread beyond Danish supplier Danfoss, with one retail boss confirming hackers gained access to installations controlled by US rival Copeland.

An E.Leclerc supermarket near Albi in southern France suffered a major refrigeration failure early on Tuesday – despite using Dixell equipment rather than the Danfoss controllers implicated in Monday's attacks.

Dixell is part of a brand owned by US ventilation and industrial systems giant Copeland.

Store director Yoan Rivera told French newspaper La Dépêche du Midi that the attack was discovered at around 4am, when staff found the refrigeration control computers had become uncontrollable.

Refrigeration industry specialist Adrient Le Norcy confirmed reports that hackers were also targeting Dixell's XWEB refrigeration systems.

New reports point to a possible cyberattack on another refrigeration supervisor, this time on Dixell systems. Refrigeration industry expert Adrient Le Norcy writes on .

"As a precautionary measure, disconnect the network cables from your monitors until you get more information and reliable instructions," Le Norcy advises.

Industry accounts suggest that dozens of operating parameters have been modified remotely at some locations, prompting refrigeration technicians to recommend disconnecting supervision systems from their networks until more information becomes available.

Dixell France has reportedly begun distributing security advisories for XWEB supervisors and on Tuesday a Copeland spokesperson acknowledged a vulnerability that has been identified in "a discontinued, end-of-life generation of controllers.”

“Protecting our customers’ operations has always been a top priority. We are currently working with impacted customers to mitigate the risk," they told Cybernews .

“We will continue to support customers in strengthening cybersecurity through supported products, current software and industry-recommended practices," Copeland added.

The incident raises concerns that hackers are exploiting weaknesses across several refrigeration brands, not just one.

Amir Preminger, chief technology officer at industrial cybersecurity specialist Claroty, warned that refrigeration controllers are often overlooked by security teams despite controlling food that keeps supermarkets running.

The firm's Team82 unit even demonstrated this at DEF CON recently.

Industrial control systems such as refrigeration controllers are often assumed to be on safely isolated networks, however, our research found many of these devices are directly exposed to the public internet. Claroty CEO Amir Preminger tells Cybernews

"That makes it cheaper and easier for engineers to fix problems remotely – but it also makes it easier for hackers to break in," he added.

France appears to be especially exposed. According to cybersecurity company SOCRadar, a scan on October 13th found almost 2,900 Danfoss systems in France alone that can be accessed from the internet – 65% of the roughly 4,500 found worldwide.

Code of the day bypass - as demonstrated at DEF CON

In August Claroty found that some units had a " code of the day " bypass that lets hackers generate a daily access code based on the device's date and time.

Claroty also found a serious security flaw in Dixell controllers, which Copeland, the equipment's maker confirmed and was working to fix.

"What's interesting here is that Claroty's Team82 stood on a DEF CON stage in August and demonstrated exactly this scenario, including falsifying temperature readings while disabling cooling," Suzu Lab's CTO, Denis Calderone told Cybernews .

"Two months later someone has operationalized it across five countries and hundreds of stores," he added.

In Monday's attacks, hackers remotely pushed some units to temperatures of 50°C.

Danfoss confirmed the affected equipment included two outdated systems, AK-SM800 and AK-SM800A, that no longer receive security updates, as well as newer AK-SM800A units running out-of-date software.

In this case all of the models that were part of the attack are end-of-life between 2016 and 2021. You cannot remediate your way out of this because the manufacturer stopped supporting these at least 3 years ago; you can only segment it, monitor it, or replace it, says Suzu Lab's CTO, Denis Calderone

Following the attack, French police have opened a criminal investigation, led by the Paris prosecutor's cybercrime unit, and the national cybersecurity agency ANSSI.

Dutch supermarkets were also hit by a separate cyberattack on Monday, with outages affecting online orders, customer service, and loyalty tools.