Today’s material change is scope, not a newly confirmed entry route. In its 13 October revision, France’s CERT-FR expanded the alert to list Copeland xweb and Dixell xweb remote refrigeration controllers alongside Danfoss AK-SM and AK-SC. The agency says it knows of numerous compromises; it does not name an attacker or confirm how each system was reached.
Why this matters
Retail refrigeration is operational technology: controller access can disrupt cooling, stock handling and store operations. The expanded list means organizations should check every named product family and the remote access used by refrigeration contractors—not only Danfoss systems. Cold-storage operators, facilities teams and service providers should coordinate across IT, OT and food-safety leads.
Priority actions
- Inventory all four series and public-facing management endpoints. Coordinate with the refrigeration provider before cutting telemetry or remote service.
- Remove direct internet access; route necessary administration through a protected network or VPN. Verify firmware, changed default passwords, security settings and defrost schedules.
- If compromise is suspected, isolate and factory-reset, then reconfigure and patch before restoring protected access. CERT-FR warns that a reset alone leaves end-of-life equipment vulnerable to reinfection.
Assessment: This alert update broadens the equipment scope; it does not establish that the same intrusion technique affected every vendor.
Primary source: CERT-FR alert CERTFR-2026-ALE-012 (revised 13 October 2026).