French Supermarket Fridge Cyberattack Spreads to Copeland's Dixell XWEB Controllers

French authorities have confirmed that the cyberattack against supermarket refrigeration systems in France is no longer limited to Danfoss equipment. On October 13, 2026, the national cybersecurity agency ANSSI updated its security alert to add XWEB supervisory controllers sold under the Dixell and Copeland brands to the list of compromised devices. Dixell is an Italian maker of electronic temperature regulators owned by the US group Copeland, a major supplier of heating, cooling and refrigeration technology.

The first visible case came from the Tarn department in southern France. At around 04:00 on Tuesday, October 13, staff at an E.Leclerc store in Lescure-d'Albigeois, near Albi, discovered that the computers controlling the refrigeration had become impossible to operate. The store director told local media that the cold chain had been broken and that the fresh and frozen products held in the affected cabinets had to be thrown away. The site runs Dixell regulation equipment, not the Danfoss controllers that were at the center of the first wave of attacks.

A second case was reported near Bordeaux, where attackers allegedly changed a freezer set point from -22°C to 150°C. A technician on site said he saw several settings being modified every second, which points to an automated tool rather than manual changes. At least two French supermarkets equipped with Dixell devices have now reported stock losses linked to the attacks.

These new incidents came barely a day after the night of October 11 to 12, when hackers forced continuous defrost cycles on refrigeration controllers in hundreds of French stores. Speaking to Parliament on October 13, Finance Minister Roland Lescure said that about 700 of the country's roughly 10,000 supermarkets had been affected by the campaign overall.

The CERT-FR alert, first issued on October 12 and revised the following day, now covers four equipment families, including Dixell XWEB and Copeland XWEB. The agency warns that further attack campaigns against these devices are probably still underway and reminds operators that exposing a management interface directly to the internet goes against good practice. It asks store operators to cut public internet access to all affected units, to check the full configuration of each unit, especially defrost schedules, and to restore remote access only through a secure VPN or a protected network. For compromised units, it recommends a factory reset followed by a complete reconfiguration, while stressing that a reset alone will not protect equipment that no longer receives security updates.

Copeland has remained cautious. A company spokesperson declined to confirm that its systems had been hacked and said the group's top priority was to protect its customers' operations. Dixell's French subsidiary has reportedly started sending security advisories about XWEB supervisors to installers, but the manufacturer has not publicly confirmed any compromise.

Weaknesses in these products were already known before the attacks. Security firm Claroty published research this year on Copeland XWEB Pro supervisory controllers, showing in a test environment how an attacker starting from an internet-exposed XWEB unit could take control of the refrigeration equipment connected to it. Copeland confirmed a serious flaw reported by the researchers and said it was working on a fix. There is no evidence so far that this specific flaw was used in the French attacks. Some refrigeration technicians also claim that the XML interface used by these supervisors can be bypassed with little effort, although this has not been independently verified.

Dixell supervisors appear to be far less common in French supermarkets than Danfoss systems, according to industry accounts, which may explain why only a handful of Dixell-equipped stores have reported damage so far. Refrigeration specialists nevertheless urged store operators to unplug the network cables of their supervision systems as a precaution until reliable instructions are available, after reports that dozens of operating parameters had been changed remotely at some sites. Some technicians fear that supervision platforms from other manufacturers, such as the Italian company Carel, could become the next target if they remain reachable from the internet. No incident involving Carel equipment has been reported at this stage.

Supermarket refrigeration is connected to the internet mainly to keep continuous, timestamped temperature records required by food safety rules, to trigger alarms when temperatures rise abnormally, and to allow contractors to carry out remote maintenance. This convenience lowers maintenance costs but also opens a direct path for attackers. CERT-FR advises operators to check their insurance contracts before cutting the data link to their refrigeration contractor, as some policies depend on this remote monitoring.

As of October 14, no group has claimed responsibility for the attacks and no ransom demand has been reported. The Paris prosecutor's cybercrime unit is leading a criminal investigation, while ANSSI is assisting victims at the request of the Prime Minister and has alerted its European counterparts. Retailers and refrigeration contractors are still restoring equipment and restocking fresh and frozen aisles, and the number of Dixell-equipped stores affected could still rise in the coming days if exposed supervisors are not taken offline quickly.