Copeland and Dixell Hacked: When Supermarket Fridges Become Cyber Weapons

Have you ever imagined that a supermarket refrigerator could be attacked by hackers, heated up to 50 degrees Celsius, causing fires and destroying tons of food? It sounds like a horror movie script, but that is exactly what is happening in France right now.

And in a latest development catching the attention of the global cybersecurity community, the French National Cybersecurity Agency (ANSSI) has just confirmed that Copeland and Dixell refrigeration systems have also been infiltrated by hackers – following previous attacks on Danfoss devices. This is no longer an isolated incident. This is a large-scale cyber attack targeting essential infrastructure across hundreds of supermarkets throughout France.

Join me, SilverZ, with 20 years of witnessing wave after wave of cyber attacks from computer viruses to ransomware, as we dissect this event from its roots. Because if you think this is a distant French affair, you are mistaken. This is a wake-up call for all of us.

What Happened? The Timeline of an Unprecedented Attack

Let's go back to the night of October 11, 2026. While the whole of France was asleep, a massive cyber attack was launched targeting internet-connected refrigeration controllers in supermarkets nationwide.

The attackers accessed remote control panels – devices that allow monitoring and adjusting the temperature of supermarket refrigerators and freezers from afar. They activated the defrost mode and let it run continuously for many hours.

The results were catastrophic: temperatures in the refrigerators soared up to 50 degrees Celsius (122 degrees Fahrenheit) in some stores. Food was completely spoiled. And worse yet, some electrical systems caught fire due to overheating.

Mr. Dominique Schelcher, CEO of the Coopérative U supermarket chain – one of the victims of the attack – shared on social media that their refrigeration systems were connected to the internet to monitor temperatures 24/7 \"in case of anomalies.\" But that very connectivity became the gateway for the attackers.

According to French Finance Minister Roland Lescure, approximately 700 out of 10,000 supermarkets in France were affected. Major supermarket chains like Carrefour, E.Leclerc, Intermarché, and Monoprix were all on the victim list. At Intermarché, about 150 stores were affected, with refrigeration units running at 50 degrees Celsius for a full 6 hours, and all food had to be discarded. Two supermarkets in Alsace reported combined damages reaching 270,000 euros (about $300,000).

The Expansion of the Attack: From Danfoss to Copeland and Dixell

Initially, CERT-FR – France's computer emergency response team under ANSSI – only warned about refrigeration controllers from Danfoss, a Danish company. Specifically, the AK-SM and AK-SC series.

But just a day later, on October 13, ANSSI updated its warning to include systems from Copeland and Dixell – specifically the XWEB and XWEB Pro series. This means the attack was not targeting a single manufacturer alone, but rather a targeted campaign aimed at multiple refrigeration control equipment brands.

Copeland, the owner of the Dixell brand, initially refused to confirm information from ANSSI. But later, they had to admit the existence of a security vulnerability in controllers belonging to "discontinued, end-of-life generations." A company spokesperson stated: "We are currently working with affected customers to mitigate risks."

The Deadly Flaw: When Passwords Are Generated From... Dates

This is the part that leaves me, with 20 years in the industry, truly stunned. How could hackers so easily break into thousands of devices like that?

The answer lies in a severe security vulnerability that researchers warned about months ago. Specifically, Danfoss controllers use a password that changes every day – but that password is generated by public firmware based on the date. Anyone analyzing the source code could generate the same password for any unupdated device.

In other words, the daily password is identical across all models located in hundreds or thousands of stores. This is not security. This is a dangerous joke.

For Copeland and Dixell, the situation was no better. In August 2026, cybersecurity firm Claroty published a detailed report on 23 security vulnerabilities in Copeland XWEB Pro controllers, of which 21 were rated as high severity. These flaws allowed attackers to "bypass authentication, cause denial of service, cause memory corruption, and execute arbitrary code."

Copeland released patches for these vulnerabilities. But as we all know, patches only work when installed. And clearly, many devices were not updated.

Damage: Beyond Just Spoiled Food

The damage figures from this attack are truly staggering:

Aspect	Damage
Number of supermarkets affected	Around 700 stores across France
Maximum recorded temperature	50°C (122°F)
Continuous defrost duration	Up to 8 hours
Damage at two supermarkets in Alsace	270,000 euros ($300,000)
Estimated industry-wide damage	Tens to hundreds of millions of euros
Countries affected	France, Spain, Portugal, Poland, Germany, Belgium

But financial losses are only the tip of the iceberg. More concerning are the series of fires that broke out in supermarkets. When the electrical systems of refrigerators overheat from running at 50 degrees Celsius for hours, electronic components can catch fire, endangering human life and property.

The Paris Prosecutor's Office has opened a criminal investigation into the matter, with a specialized cybercrime unit working to identify the perpetrators. So far, no group has claimed responsibility, and no ransom demands have been issued.

Hard-Learned Lessons: What Should Have Been Done Long Ago

What breaks my heart the most when reading about this incident is: it was completely preventable. Researchers warned about these vulnerabilities months, even over a year, in advance.

In October 2025, Claroty published research on vulnerabilities in Danfoss AK-SM 800A controllers, bearing the telling title: "Freeze the controller, defrost the food." They warned precisely about the scenario we are witnessing today.

In February 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) also issued alerts regarding nearly two dozen vulnerabilities in Copeland XWEB and XWEB Pro.

So why were these warnings ignored? The answer lies in complacency and a lack of investment in security.

As researchers at Pen Test Partners pointed out, there are two things that should have changed the outcome:

• Basic network hygiene: Removing controllers from the public internet, placing remote access behind a VPN and allowed IP lists, changing default credentials, and applying updates.
• Third-party device management: Bringing vendor equipment into the network in a controlled manner, rather than leaving them on a contractor's private connection.

These are neither complex nor expensive measures. These are fundamental principles that any cybersecurity expert would recommend. But in reality, they are often overlooked for convenience or lack of risk awareness.

Why This Story Matters to Vietnamese Businesses

You might be thinking: "This is a French story, what does it have to do with Vietnam?"

Let me tell you, it has a lot to do with it.

First, the affected devices are present in Vietnam. Copeland, Dixell, and Danfoss are all popular refrigeration equipment brands in supermarkets, food store chains, restaurants, and cold storage facilities in Vietnam. If these devices are connected to the internet without proper protection, they could become the next target.

Second, the IoT trend in the retail industry is growing. More and more Vietnamese businesses are investing in remote monitoring solutions, smart energy management, and supply chain automation. Every connected device is a potential entry point for attackers if not properly secured.

Third, this is a wake-up call regarding complacency. Many Vietnamese businesses still believe "we are not a target" due to small scale or operating in less-noticed fields. But hackers do not care about your scale. They care about vulnerabilities. And a forgotten, unupdated refrigeration device still connected to the internet is a perfect vulnerability.

Fourth, the damage from this incident can spread widely. As we have seen, the attack not only affected France but also spread to Spain, Portugal, Poland, Germany, and Belgium. In a connected world, cyber attacks know no borders.

Take Action Now: What Vietnamese Businesses Need to Do

Don't wait until an incident happens to you. Here are steps you can take starting today:

1. Audit Your Equipment

Determine whether your business is using Danfoss AK-SM/AK-SC, Copeland XWEB, or Dixell XWEB refrigeration controllers. If so, immediately assess their internet exposure level.

2. Disconnect from the Public Internet

This is the most critical emergency measure. If these devices do not need public internet access, disconnect them immediately. If remote access is required, place them behind a VPN and restrict the allowed IP list.

3. Update Firmware and Change Default Passwords

Ensure all devices are running the latest firmware versions. Change all default passwords. Set security configurations to "strict" mode if available.

4. Review Service Provider Contracts

Check contract terms with refrigeration maintenance service providers. Ensure that security responsibilities are clearly defined, and third-party devices are managed in a controlled manner.

5. Build an Incident Response Plan

If your device is compromised, you need to know what to do. Establish a clear response process, including isolating affected devices, restoring factory configurations, and notifying stakeholders.

When Refrigerators Become Weapons

I have watched the cybersecurity industry go through quite a few revolutions over the past two decades. From simple computer viruses, to ransomware extortion, to targeted attacks on critical infrastructure. Each technological advance opens up new vulnerabilities that attackers can exploit.

But this attack on supermarket refrigeration systems marks a frightening turning point. For the first time, we are witnessing a large-scale cyber attack directly targeting the food supply chain – one of society's most fundamental pillars. When refrigerators can be turned into weapons, when food can be destroyed with just a click of a mouse, we are facing an entirely new threat.

And like every technological revolution, the winner is not the strongest, but the best prepared. The question is no longer "Can this happen to me?", but "When it happens, what will I do?"

What do you think about the scenario where attackers can remotely control refrigeration devices in supermarkets, restaurants, and even hospitals and pharmaceutical warehouses? If your business uses internet-connected IoT devices – whether fridges, cameras, or air conditioning systems – do you truly understand your exposure level? And more importantly, are you willing to invest in security today, or are you waiting for an incident to happen and pay the price with hundreds of millions of dong and your reputation? Share your perspective below, because in this connected world, your safety depends entirely on you!