Food safety fears grow as Copeland is named as second fridge supplier hit in supermarket hacking spree

Cyberattacks that knocked out fridges and spoiled food across French supermarkets may have spread beyond Danish supplier Danfoss, with one retail boss confirming hackers gained access to installations controlled by US rival Copeland.

An E.Leclerc supermarket near Albi in southern France suffered a major refrigeration failure early on Tuesday – despite using Dixell equipment rather than the Danfoss controllers implicated in Monday's attacks.

Dixell is part of a brand owned by US ventilation and industrial systems giant Copeland.

Store director Yoan Rivera told French newspaper La Dépêche du Midi that the attack was discovered at around 4am, when staff found the refrigeration control computers had become uncontrollable.

Refrigeration industry specialist Adrient Le Norcy confirmed reports that hackers were also targeting Dixell's XWEB refrigeration systems.

New reports point to a possible cyberattack on another refrigeration supervisor, this time on Dixell systems.

Refrigeration industry expert Adrient Le Norcy writes on LinkedIn.

"As a precautionary measure, disconnect the network cables from your monitors until you get more information and reliable instructions," Le Norcy advises.

Industry accounts suggest that dozens of operating parameters have been modified remotely at some locations, prompting refrigeration technicians to recommend disconnecting supervision systems from their networks until more information becomes available.

Dixell France has reportedly begun distributing security advisories for XWEB supervisors, although the manufacturer has yet to publicly confirm any compromise.

Cybernews has approached Copeland for comment.

The incident raises concerns that hackers are exploiting weaknesses across several refrigeration brands, not just one.

Amir Preminger, chief technology officer at industrial cybersecurity specialist Claroty, warned that refrigeration controllers are often overlooked by security teams despite controlling food that keeps supermarkets running.

Industrial control systems such as refrigeration controllers are often assumed to be on safely isolated networks, however, our research found many of these devices are directly exposed to the public internet.

Claroty CEO Amir Preminger tells Cybernews

"That makes it cheaper and easier for engineers to fix problems remotely – but it also makes it easier for hackers to break in," he added.

France appears to be especially exposed. According to cybersecurity company SOCRadar, a scan on October 13th found almost 2,900 Danfoss systems in France alone that can be accessed from the internet – about 65% of the roughly 4,500 found worldwide.

Was the password really just today's date?

Reports have claimed that every Danfoss controller used the same login – username "admin" and a password that was simply the current date. That's not quite accurate.

Claroty researchers found a flaw that let attackers bypass the administrator password altogether. Instead of the real password, hackers could generate a daily access code based on the device's date and time.

Claroty also found a serious security flaw in Dixell controllers, which Copeland, the equipment's maker, confirmed and was working to fix.

There's no evidence yet that either flaw was used in the French attacks.

In Monday's attacks, hackers remotely pushed some units to temperatures of 50°C.

Danfoss confirmed the affected equipment included two outdated systems, AK-SM800 and AK-SM800A, that no longer receive security updates, as well as newer AK-SM800A units running out-of-date software.

French police have opened a criminal investigation, led by the Paris prosecutor's cybercrime unit, and the national cybersecurity agency ANSSI is involved at the request of the Prime Minister.

Dutch supermarkets were also hit by a separate cyberattack on Monday, with outages affecting online orders, customer service, and loyalty tools.