France Warns Refrigeration Controllers Are Under Active Compromise

France's national CERT updated an active alert on October 13 after observing numerous compromises of remote refrigeration controllers. The warning now covers multiple product families and says attack campaigns are probably still underway. ## Affected systems CERT-FR identifies Danfoss AK-SM and AK-SC series controllers, Copeland XWEB systems and Dixell XWEB systems. These devices supervise commercial refrigeration installations and can expose remote administration functions. The alert does not say that every model or deployment is compromised; it names the families seen in the campaign. ## Access path The confirmed common exposure is a management interface reachable from a public IP address. CERT-FR says direct Internet exposure is contrary to good practice and should be removed. It has not attributed the campaign to a specific actor or tied every incident to one CVE, credential failure or exploit chain. Danfoss and Copeland separately document security fixes for some controller versions, but those advisories do not by themselves establish the exact method used in this campaign. ## Impact A successful compromise gives an unauthorized party control over a system responsible for refrigeration monitoring and configuration. That creates an integrity and availability risk for the cooling process and can force operators to take equipment out of remote service while it is rebuilt. CERT-FR's primary alert confirms numerous compromises but does not quantify affected stores, equipment downtime, product loss or financial damage. ## Mitigations For equipment not believed compromised, CERT-FR recommends removing Internet exposure, reviewing the entire configuration including defrost schedules, and restoring remote access only through a secured VPN or protected network. Temporary source-IP filtering can reduce exposure but is not a durable replacement. Operators should install current firmware, enable strict security settings where supported and replace default passwords. For suspected compromises, CERT-FR advises removing public access, performing a factory reset, rotating secrets, reviewing accounts, fully reconfiguring the controller and applying all available security updates before reconnection. It warns that a reset alone is insufficient for unsupported equipment that remains exposed. ## Uncertainty CERT-FR has not published attribution, a definitive initial-access technique, a victim count or a complete model-and-version matrix. Its October 13 update broadened the affected product list beyond Danfoss, which indicates the investigation is still changing. Operators should follow the live alert and vendor guidance rather than infer that one patch or one product family explains the whole campaign.