{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/copeland/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AK-SM series controllers","AK-SC series controllers","XWEB systems"],"_cs_severities":["high"],"_cs_tags":["industrial-control-systems","internet-exposed-device","authentication-bypass","supply-chain"],"_cs_type":"advisory","_cs_vendors":["Danfoss","Copeland","Dixell"],"content_html":"\u003cp\u003eMultiple European supermarket chains in Belgium, Sweden, Ireland, the Netherlands, Finland, Italy, Portugal, and Estonia have reported targeted attacks on industrial refrigeration controllers. Attackers are gaining unauthorized access to internet-reachable management interfaces of Danfoss and Copeland/Dixell devices, forcing evaporators into defrost mode, which results in significant temperature increases and food loss. Experts confirm many targeted units are legacy, end-of-life devices lacking vendor patches. Initial findings indicate usage of publicly documented factory-default credentials to gain entry.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eReconnaissance: Attackers identify internet-exposed refrigeration management interfaces (e.g., Danfoss StoreView).\u003c/li\u003e\n\u003cli\u003eInitial Access: Attackers authenticate to the management interface using known factory-default credentials.\u003c/li\u003e\n\u003cli\u003eExecution: Attackers modify controller settings to force the refrigeration unit into an active defrost cycle.\u003c/li\u003e\n\u003cli\u003eImpact: The cooling mechanism is overridden, causing internal unit temperatures to rise (up to 50°C), resulting in spoiled food and potential fire hazards.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eOver 100 stores across Europe have been affected, including major retailers like Delhaize, Carrefour, and Spar. Reported impacts include massive food spoilage, financial losses for small and large grocers, and operational disruption to the regional food supply chain.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify and inventory all internet-facing refrigeration management systems (specifically Danfoss AK-SM, AK-SC series, and Copeland/Dixell XWEB systems).\u003c/li\u003e\n\u003cli\u003eImmediately remove industrial refrigeration controllers from the public internet.\u003c/li\u003e\n\u003cli\u003eImplement strict network segmentation and place controllers behind a secure VPN or firewall requiring multi-factor authentication for access.\u003c/li\u003e\n\u003cli\u003eAudit all management interfaces for the use of default factory credentials and replace them with unique, strong passwords.\u003c/li\u003e\n\u003cli\u003eFor end-of-life units that cannot be patched, apply physical isolation or replace the controller with modern, supported hardware.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T08:06:20Z","date_published":"2026-11-03T08:06:20Z","id":"https://feed.craftedsignal.io/briefs/2026-11-supermarket-fridge-attacks/","summary":"Attackers are exploiting internet-exposed industrial refrigeration controllers using factory-default credentials to force units into defrost mode, causing temperature spikes and food spoilage across European retail chains.","title":"Industrial Refrigeration Controller Unauthorized Access and Temperature Tampering","url":"https://feed.craftedsignal.io/briefs/2026-11-supermarket-fridge-attacks/"}],"language":"en","title":"CraftedSignal Threat Feed - Copeland","version":"https://jsonfeed.org/version/1.1"}