France's CERT-FR issued alert CERTFR-2026-ALE-012 on 12 October 2026 (latest version 16 October) saying it knows of numerous compromises of remote controllers for refrigeration installations: Danfoss AK-SM and AK-SC series, Copeland xweb and Dixell xweb.

CERT-FR says exposing a management interface on the internet is contrary to good practice, warns that attack campaigns against this equipment are probably still under way, and says internet-exposed equipment without security fixes (end of life) is very likely to be compromised; a factory reset alone removes an intruder's persistence but leaves the unit vulnerable, so it will almost certainly be compromised again. CERT-FR has not named a vulnerability.

Earlier public research gives a possible path: Claroty Team82 found a hidden date-based 'code of the day' login in the Danfoss AK-SM 800A that bypasses the admin password (CVE-2025-41450, fixed in R4.2), plus post-login command injection fixed in 4.3.1; CERT-FR does not say this flaw was used.

UPDATE 14 October: ASD's ACSC issued a High alert (act within 48 hours), Protecting operational technology and edge devices, saying it is aware of incidents affecting commercial refrigeration systems overseas and has not seen active targeting in Australia. It recommends that Australian organisations running internet-connected OT, including commercial refrigeration, keep OT interfaces and edge devices off the internet, patch known vulnerabilities promptly, apply strong authentication, access control and segmentation, and monitor for unusual automated activity.

CORRECTION (21 Oct 2026): this card earlier carried store counts, temperatures, losses, fires, a claim that Copeland acknowledged a vulnerability, and statements attributed to Danfoss, Les Mousquetaires, Carrefour, Coopérative U and others, from media reports we had not linked. We removed them; they will return only with a linked source for each claim.