France’s cybersecurity agency has widened its warning over the October 11 refrigeration attack to cover Copeland XWEB and Dixell XWEB controllers alongside Danfoss AK-SM and AK-SC series. Copeland declined to confirm ANSSI’s findings at first, then acknowledged a vulnerability and said it is working with affected customers.
Danfoss points at the hardware’s age. Most affected units are AK-SM 800 and AK-SC 355 systems that reached end of life years ago and receive no patches — Danfoss stopped supporting the AK-SM 800 in May 2021, and the AK-SC 355 was discontinued in 2016. Some current AK-SM 800A controllers running outdated firmware were caught too. How the attackers got in remains unestablished, and no claim of responsibility or ransom demand has emerged.
The reach is wider than France. Sekoia told Reuters that stores in Spain, Portugal, Poland, Germany, and Belgium were also affected. Reuters puts total losses in the tens of millions of euros, and insurance brokers warn standard cyber policies often exclude physical damage.
CERT-FR wants affected controllers off the internet, with remote access restored only through a secure VPN or protected network. For compromised end-of-life devices, a factory reset won’t do — the device stays vulnerable and gets hit again if it remains exposed. Operators appear to be listening: Censys counted more than 1 800 exposed Danfoss panels in France on October 11, and 537 by October 14, with patched and unpatched versions vanishing at the same rate.
Source: SecurityWeek
