A refrigeration system in a supermarket is assembled from several companies' products and then serviced by at least one more. The French incident touched equipment from Danfoss and from Copeland and its Dixell brand, according to ANSSI's CERT-FR, and the alert was widened a day after the first warning to include Copeland XWEB and Dixell XWEB systems.
For an asset owner, that widening is the interesting part. It shows how quickly an incident escapes a single vendor's inventory.

The chain as it usually looks

A typical store has a refrigeration plant specified by an engineering contractor, controller hardware from one or two vendors, a monitoring platform from another, and a facilities maintenance provider that holds remote access to all of it. Each link keeps its own records.
CERT-FR's first warning on 12 October covered Danfoss AK-SM and AK-SC series controllers. A day later the agency added Copeland XWEB and Dixell XWEB systems. Copeland initially declined to confirm the agency's findings, then acknowledged a vulnerability and said it was working with impacted customers to mitigate the risk.

What a purchase order will not tell you

Procurement records describe what was bought, not what is reachable. Two questions bridge the gap:

  • which of these controllers expose an interface to the public internet, regardless of who installed it

  • which third parties hold credentials to that interface today
    Neither answer appears in a contract. Both are needed before an incident.

A cross-check from outside

In a ZoomEye session on 21 October 2026, title="StoreView Web" returned 271 assets, with 55 in France. A separate query for title="AK-SM" returned 2. The difference between these figures is not a measure of safety. It shows that only some controller families advertise a recognisable title, so external measurement complements the chain inventory rather than replacing it.

Contract clauses that help during an incident

Three clauses shorten the response. A duty to notify the retailer of any anomalous control command within a stated period. A requirement that vendor remote access terminate at a broker the retailer logs. And an agreed owner for end-of-life decisions, since the AK-SM 800 lost support in May 2021 and the AK-SC 355 was discontinued in 2016, long before this month.
Les Mousquetaires said Danfoss managed the refrigeration systems and that the supplier must file a complaint, Bloomberg reported. Assigning the complaint does not assign the risk.

References

  • SecurityWeek, supermarket refrigeration attack coverage: https://www.securityweek.com/supermarket-refrigeration-attack-widens-to-copeland-dixell-controllers/

  • CERT-FR alert CERTFR-2026-ALE-012: https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/

  • ZoomEye queries executed 21 October 2026.