France’s national cybersecurity authorities have raised the alarm over a series of attacks on the remote controllers that manage commercial refrigeration systems at several supermarkets in France. CERT-FR, the government’s computer emergency response team, which operates under the National Cybersecurity Agency (“ANSSI”), issued a bulletin on October 12, 2026, reporting numerous compromises affecting Danfoss AK-SM and AK-SC series controllers, as well as Copeland XWEB and Dixell XWEB devices. ANSSI did not cite any particular legal violation but indicated that the attacks succeeded because the devices’ management interfaces were accessible from the public internet, a practice that is considered contrary to best practices. CERT-FR also indicated that attack campaigns are probably still underway and that devices left online without the latest security patch face a very high probability of compromise.
To contain the threat, the agency set out a series of steps that depend on whether an operator’s equipment has already been breached. The first step for every operator is to take affected devices offline, along with any device exposed to a public IP address. Operators are urged to check their insurance contracts before cutting off the data feed to their refrigeration service provider, and then to review their entire setup, including defrost settings. Remote access should be restored only through a secure VPN or a protected network. The agency warned that a factory reset alone is not enough. According to ANSSI, although a reset removes the attackers’ foothold, the equipment remains exposed and could be compromised again.
The incidents have drawn attention well beyond France. In an October 14, 2026 statement, the Operational Technology Cybersecurity Coalition (“OTCC”) – an industry-led trade association and advocacy group based in Washington, D.C. – addressed the attacks on France’s food and agriculture sector, which reportedly affected hundreds of grocery stores. Noting that French and European authorities have not identified who was behind the attacks, the coalition described the incident as “another stark reminder” that baseline operational technology (“OT”) cybersecurity measures are needed. The coalition also renewed its call for the U.S. Cybersecurity and Infrastructure Security Agency (“CISA”) to issue a binding operational directive on OT cybersecurity across the federal government in order to show the private sector what steps to take and allow the U.S. Department of Agriculture to recommend best practices for the food and agriculture sector. Although no incidents have been reported in the United States, the OTCC warned that malicious actors are “undoubtedly” viewing the attack as a potential model for strikes there.
CERT-FR Alert Bulletin | OTCC Statement