For awareness Critical Check exposure in your normal cycle
Internet-exposed refrigeration controls found in 99 countries after French supermarket attacks
Industrial CyberForescout, Danfoss, Copeland · food retail, cold chain, healthcare
What happened. Forescout's Vedere Labs found 12,976 internet-exposed service observations tied to refrigeration control systems on 6,017 public IP addresses in 99 countries and territories. In France, over 700 supermarkets reportedly had temperature and defrost controls changed, causing food losses.
Who is affected. CERT-FR confirmed Danfoss AK-SM and AK-SC, Copeland and Dixell XWEB systems in the French incidents. The research also names food retail, cold chain and hospitals as at risk.
What to do. Check whether any refrigeration management interfaces, such as Danfoss AK-SM/AK-SC, Copeland or Dixell XWEB, are reachable from the internet, and remove public access.
When to act. For awareness: background reading, nothing to schedule
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L5
- L2
- L1
Why: Refrigeration management and supervisory interfaces (L2) control refrigeration equipment (L1) and, in the exposed cases, are reachable directly from the internet (L5).
- Are you exposed?
Search your asset inventory and external IP ranges for Danfoss AK-SM/AK-SC, Copeland or Dixell XWEB management interfaces reachable from the internet.
- If you cannot fix it yet
- Remove refrigeration management interfaces from direct internet access and place them behind a firewall.
- Require a VPN with multi-factor authentication for any remote access to refrigeration supervisory systems.
- Restrict access to the management interface to known administrator addresses.
- Watch for
- Unexpected changes to refrigeration temperature setpoints or defrost schedules, especially outside normal maintenance windows.
- Logons to refrigeration management web interfaces from unfamiliar internet addresses.
- ATT&CK for ICS
- T0886Remote ServicesT0831Manipulation of Control
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Industrial Cyber (opens industrialcyber.co)
More on Forescout Danfoss Copeland Food and agriculture Healthcare