Copeland Named as Second Refrigeration Supplier Hit in French Supermarket Hacking Spree

Hackers have hit a second refrigeration supplier in a cyberattack campaign against French supermarkets, with an E.Leclerc store near Albi suffering a major refrigeration failure after equipment made by US firm Copeland was compromised. The incident follows attacks a day earlier that were linked to Danish supplier Danfoss.

Second supplier confirmed

The E.Leclerc supermarket in southern France uses Dixell equipment rather than the Danfoss controllers implicated in Monday's attacks. Dixell is part of a brand owned by Copeland, a US ventilation and industrial systems company. Store director Yoan Rivera told French newspaper La Dépêche du Midi that the attack was discovered at around 4am, when staff found the refrigeration control computers had become uncontrollable.

Refrigeration industry specialist Adrient Le Norcy confirmed that hackers were also targeting Dixell's XWEB refrigeration systems and advised operators to disconnect network cables from their monitors as a precaution. On Tuesday, a Copeland spokesperson acknowledged a vulnerability in "a discontinued, end-of-life generation of controllers" and said the company was working with impacted customers to mitigate the risk.

Thousands of controllers exposed online

Cybersecurity company SOCRadar said a scan on October 13th found almost 2,900 Danfoss systems in France that can be accessed from the internet, about 65% of the roughly 4,500 found worldwide. Claroty CTO Amir Preminger said refrigeration controllers are often overlooked by security teams, and his firm's Team82 unit demonstrated the exact attack scenario at DEF CON in August, including falsifying temperature readings while disabling cooling.

Claroty also found a "code of the day" bypass that lets hackers generate a daily access code based on the device's date and time, plus a serious flaw in Dixell controllers that Copeland confirmed and was working to fix. Suzu Lab CTO Denis Calderone said the DEF CON demo was operationalized two months later "across five countries and hundreds of stores."

Investigation underway

In Monday's attacks, hackers remotely pushed some units to temperatures of 50°C. Danfoss confirmed the affected equipment included two outdated systems, the AK-SM800 and AK-SM800A, that no longer receive security updates, as well as newer AK-SM800A units running out-of-date software. All models involved are end-of-life between 2016 and 2021, and Calderone said they cannot be remediated, only segmented, monitored, or replaced.

French police have opened a criminal investigation led by the Paris prosecutor's cybercrime unit, and the national cybersecurity agency ANSSI is also involved. Dutch supermarkets were separately hit by a cyberattack on Monday, with outages affecting online orders, customer service, and loyalty tools.

Sources: Cybernews