Read the CERT-FR alert carefully and one absence stands out. The alert does not link the compromises to any specific vulnerability. Neither Danfoss nor French authorities have tied the attack to the flaws Claroty disclosed in refrigeration controllers earlier this year.
That gap is not a failure of the alert. It is an accurate description of what is currently known, and it matters for how defenders prioritise.

What the public record establishes

  • CERT-FR warned on 12 October of numerous compromises involving Danfoss AK-SM and AK-SC series controllers, and updated the alert on 13 October to include Copeland XWEB and Dixell XWEB systems.

  • About 700 of France's roughly 10,000 supermarkets were affected, Finance Minister Roland Lescure told lawmakers, revising earlier reports of 300 to 350.

  • The Paris prosecutor's office cybercrime unit opened an investigation, and the attack caused fires in addition to food losses.

  • Investigators were reportedly puzzled by the lack of either a claim of responsibility or a ransom demand, Reuters reported.

What remains open

The initial access vector is not public. Copeland patched the 23 vulnerabilities Claroty found in XWEB Pro controllers in a firmware update, but no authority has stated that these flaws were used here. Danfoss said most affected devices were end-of-life AK-SM 800 and AK-SC 355 units, which raises the possibility of an unpatched weakness without confirming it.

Why the gap should change your priority order

When attribution is unknown, controls that do not depend on a specific CVE become the ones worth buying. Removing a controller from the public internet works whether the entry point was a known flaw, a default credential, or a vendor portal. Brokering vendor access through an observable gateway works under the same uncertainty.
Conversely, chasing a CVE identifier that has not been linked to the incident spends effort on an unproven hypothesis.

Measuring without attributing

An external count is a neutral observation. ZoomEye query for title="StoreView Web" on 21 October 2026 returned 271 assets globally and 55 in France. It says nothing about which of those were involved, and it should not be presented as evidence of compromise.
Used that way, measurement supports the defensive work without overstating the case. The honest summary of the incident's technical cause remains: not yet public.

References

  • SecurityWeek, supermarket refrigeration attack coverage: https://www.securityweek.com/supermarket-refrigeration-attack-widens-to-copeland-dixell-controllers/

  • CERT-FR alert CERTFR-2026-ALE-012: https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/

  • Reuters, investigators find no claim of responsibility: https://www.reuters.com/legal/litigation/investigators-hunt-french-supermarket-fridge-hackers-no-claim-responsibility-2026-10-13/

  • Claroty Team82, Copeland XWEB Pro controller research: https://claroty.com/team82/research/chilling-discoveries-unpacking-vulnerabilities-in-copeland-xweb-pro-controllers

  • ZoomEye query executed 21 October 2026.