CERT-FR Expands Warning to Copeland and Dixell Refrigeration Controllers
France’s CERT-FR added Copeland xweb and Dixell xweb devices to its warning about compromised remote controllers for refrigeration systems.
CERT-FR’s warning has expanded to include additional controllers for commercial refrigeration systems. France’s cyber incident response center added Copeland xweb and Dixell xweb products on October 13 to the previously listed Danfoss AK-SM and AK-SC series. The agency says it is aware of numerous compromises involving remotely managed devices and that the attack campaigns are likely continuing.
The warning concerns systems used to monitor and remotely control refrigeration in commercial operations. If attacked, they could disrupt the cold chain. This could result in operational outages or the disposal of food if the required temperature cannot be maintained.
CERT-FR warning: remove direct internet exposure
CERT-FR recommends that operators remove the direct internet connection of affected devices. Remote access should be restored only through a secure VPN or protected network. For units confirmed to be compromised, the agency recommends performing a factory reset and then reconfiguring the device.
The recommendation concerns more than software updates. Operators should check whether their controllers are directly accessible from the internet and review their remote-management settings.
Earlier bulletin for XWEB PRO
In February, Copeland issued a security bulletin for the XWEB PRO product. According to the company, firmware version 1.13 addresses the vulnerabilities identified at that time. The manufacturer also recommended not exposing controllers to the public internet.
However, it has not been publicly confirmed which specific model, firmware, or vulnerability the attackers exploited in the current Copeland and Dixell compromises. It has likewise not been confirmed that the incident is related to the XWEB PRO vulnerabilities fixed in firmware 1.13.
Approximately 700 supermarkets affected in France
AP reported that approximately 700 supermarkets were affected in France. No perpetrator has been publicly identified, and no claim of responsibility for the attacks has been released. The exact extent of the damage, the number of affected operations by supplier, and whether all reported European incidents have a common origin also remain unclear.
For operators, the CERT-FR recommendation is immediately relevant: do not wait for a specific CVE to be assigned or for the exploited vulnerability to be confirmed, and remove the controllers’ direct internet exposure. If an attack is suspected, the device should be factory-reset and reconfigured.
What to watch next
- Further CERT-FR alerts and the results of the French authorities’ investigation,
- Confirmation of the intrusion technique, affected versions, and indicators of compromise,
- Copeland’s position on product generations and a possible connection to already fixed flaws,
- New reports of disrupted food supplies or affected retail chains.
Sources
- CERT-FR / ANSSI – CERTFR-2026-ALE-012 – Confirms the warning’s expansion on October 13 to Copeland xweb and Dixell xweb, numerous compromises, likely ongoing campaigns, and recommended mitigations.
- Copeland Controls – Security update advisory for XWEB PRO – Confirms previously identified XWEB PRO vulnerabilities, the release of firmware 1.13, and the recommendation not to expose systems to the public internet.
- Associated Press – Corroborates the approximate scale of 700 affected supermarkets, the ongoing investigation, and the absence of a publicly identified perpetrator.
- SecurityWeek – Corroborates that CERT-FR’s expansion of the warning to Copeland and Dixell is a recent development in the incident.
Verified and updated: 10/15/2026 15:26
