Update: Six Hours at 50°C and Not a Single Alarm

On Tuesday I wrote about somebody defrosting a few hundred French supermarkets from a keyboard. It's Thursday now and that story has gotten bigger every day.

Hundreds turned out to mean about 700

France's finance minister, Roland Lescure, says roughly 700 of the country's 10,000 or so supermarkets were hit. That's around one in fourteen. Carrefour is now on the list with 80 stores, and so is Monoprix, joining Intermarché, Coopérative U and E.Leclerc. The per-chain numbers still bounce around depending on who you ask, but nobody's counting down. Two Coopérative U stores in Alsace alone report €270,000 in combined losses, which is a lot of yogurt.

Now we know why nothing beeped

My title asked how this ran for six hours without a single alarm. According to Le Monde, the attackers stretched the defrost cycles from one hour to as long as eight. A long defrost is something the system expects to see, so the alarms that should have gone off politely waited. The attackers used the controller's own normal behavior to hide what they were doing. That's clever, and I hate it.

And remember the fires I mentioned on Tuesday? Still true. Fires. In grocery stores. From a refrigeration controller. Let that settle in next time somebody tells you an internet-connected box "only controls the fridges."

More brands on the list

On Monday, CERT-FR (France's national computer emergency team) was warning about Danfoss AK-SM and AK-SC refrigeration controllers. On Tuesday it added Copeland XWEB and Dixell XWEB systems to the alert. So we're up to several brands of controllers that hold the cold chain together, all reachable from the open Internet. Good news, everyone, it's a whole category.

Copeland has acknowledged a vulnerability and says it's working with affected customers. Claroty had already disclosed 23 flaws in the XWEB Pro controller back before any of this, and those were fixed in a firmware update. Whether stores actually installed it is a different question.

The devices that got hit are old. Really old.

Danfoss says most of the compromised units are AK-SM 800 and AK-SC 355 controllers. Support for the AK-SM 800 ended in May 2021. The AK-SC 355 was discontinued in 2016. So in 2026, some of the largest grocery chains in Europe were running their cold storage on hardware that stopped getting updates five to ten years ago, and they put it on the Internet. Some newer AK-SM 800A units running outdated firmware got hit too, just so the old ones wouldn't feel lonely.

Censys counted nearly 3,000 Danfoss StoreView control panels exposed to the Internet on October 11, more than 1,800 of them in France. By October 14 the French number was down to 537. That's real progress, and it also means over 1,200 of these were unplugged from the Internet in about three days. Turns out you can do it pretty quickly once your stores are on fire.

And other countries, too

Sekoia says stores in Spain, Portugal, Poland, Germany and Belgium were also affected, although there aren't many details yet. The Dutch NCSC says a separate cyberattack on Ahold Delhaize isn't connected, which I guess counts as good news this week.

Nobody has claimed responsibility. Nobody has asked for a ransom. So somebody spent the time to get into hundreds of stores across several countries, hid it from the alarms, and didn't even ask for money. Wonderful.

We still don't know how they got in

CERT-FR hasn't tied the compromises to a specific vulnerability, and neither Danfoss nor French authorities have linked it to the flaws Claroty found. My best guess on Tuesday was a built-in maintenance login or the service company's remote connection, and nothing so far has confirmed or ruled that out.

What CERT-FR does say is close to what I wrote on Tuesday: get these controllers off the Internet, and only allow remote access through a secure VPN or protected network. IP filtering is only acceptable as a temporary emergency fix. And for compromised end-of-life devices, a factory reset doesn't help, because the device is just as vulnerable as it was if you put it back online.

That last part is the one that gets me. There's no patch for these units, ever. The only fix is to stop letting them talk to the outside world, or replace them.

The layer I described on Tuesday still holds up. Separate temperature monitoring and heater power control on an isolated local network, with its own alerts that don't depend on the controller being honest. If the main controller has been told to run an eight-hour defrost, the thing watching the case temperature doesn't care what it was told. It just sees the temperature going up.

Seven hundred stores, several countries, fires, and a decade-old controller on the open Internet. And the fix is still to unplug it from the Internet.