Full Report
They tried to sound the alarm in August
Analysis Summary
# Incident Report: French Supermarket Refrigeration Exploitation
## Executive Summary
In October 2026, unknown threat actors exploited unpatched vulnerabilities in internet-exposed refrigeration controllers, affecting approximately 700 supermarkets across France. The attackers manipulated temperature settings to levels as high as 122°F (50°C), resulting in massive food spoilage and several reported fires. Despite multiple researcher warnings and CISA advisories issued months prior, hundreds of devices remained unpatched and publicly accessible, leading to significant operational disruption.
## Incident Details
- **Discovery Date:** Sunday night, October 11, 2026 (approximate based on report date)
- **Incident Date:** October 11-12, 2026
- **Affected Organization:** Nearly 700 supermarkets (various brands)
- **Sector:** Food and Agriculture / Retail
- **Geography:** France (Primary), with global exposure noted in the US and UK.
## Timeline of Events
### Initial Access
- **Date/Time:** Sunday Night, October 11, 2026.
- **Vector:** Publicly accessible web admin panels (OT devices).
- **Details:** Attackers targeted Danfoss (AK-SM 800A series) and Copeland/Dixell (XWEB/XWEB Pro) refrigeration controllers exposed to the open internet.
### Lateral Movement
- **Details:** The report indicates direct exploitation of OT controllers via the internet; specific movement from OT to IT networks was not detailed, as the controllers themselves were the primary targets.
### Data Exfiltration/Impact
- **Impact:** Intentional manipulation of temperature set-points to 122°F (50°C).
- **Damage:** Mass spoilage of perishable goods and fires triggered by system overheating.
### Detection & Response
- **Detection:** Discovered following physical alarms and system failures at retail locations on Sunday night.
- **Response Actions:** France's national cybersecurity agency (ANSSI) issued emergency alerts (CERTFR-2026-ALE-012) on Monday and Tuesday to warn operators of the specific compromised hardware brands.
## Attack Methodology
- **Initial Access:** Exploitation of authentication bypass and command execution flaws in web-accessible admin panels.
- **Persistence:** Utilization of outdated firmware and discontinued "end-of-life" hardware that lacks modern security controls.
- **Defense Evasion:** Exploiting "shadow OT"—devices forgotten by IT departments that do not receive regular security updates.
- **Discovery:** Scanning for unique IP addresses exposing "Danfoss StoreView" or "XWEB" login pages.
- **Impact:** Denial of Service (Refrigeration failure) and physical damage (Fire/Spoilage).
## Impact Assessment
- **Financial:** Massive losses due to inventory spoilage (hundreds of stores) and equipment damage.
- **Data Breach:** None reported; focus was on operational sabotage.
- **Operational:** Total shutdown of refrigeration systems across 700 locations; business continuity interrupted.
- **Reputational:** Public concern regarding food safety and supply chain stability.
## Indicators of Compromise
- **Network Indicators:**
- Publicly accessible admin panels on ports associated with Danfoss StoreView.
- Publicly accessible XWEB interfaces.
- **Behavioral Indicators:**
- Unauthorized changes to temperature set-points (e.g., shifts to 50°C).
- Unexplained system reboots or "frozen" controller interfaces.
## Response Actions
- **Containment:** Disconnecting exposed controllers from the public internet.
- **Eradication:** Patching Danfoss devices to firmware R4.3.1; mitigating risks on discontinued Copeland/Dixell devices.
- **Recovery:** Coordination between manufacturers (Copeland/Danfoss) and impacted customers to restore safe operating parameters.
## Lessons Learned
- **Delayed Patching:** A significant gap existed between the August 2026 vulnerability disclosure (Team82) and the October attacks.
- **OT Visibility:** Organizations were unaware of how many refrigeration controllers were directly reachable via the internet.
- **Lifecycle Management:** Use of end-of-life (EOL) equipment created a permanent vulnerability surface that could not be fully secured via software updates.
## Recommendations
- **Network Segmentation:** Place all Industrial Control Systems (ICS) and OT controllers behind a VPN or firewall; never expose admin panels to the public internet.
- **Asset Inventory:** Conduct comprehensive scans to identify "hidden" OT devices.
- **Proactive Patching:** Prioritize CISA Industrial Control Systems advisories (e.g., ICSA-25-140-03) with the same urgency as IT patches.
- **Hardware Retirement:** Develop a phase-out plan for legacy controllers that no longer receive security support from the manufacturer.