安全研究人员在数月前，甚至在一起案例中超过一年的时间里，就警告称存在可被利用的冷却控制器漏洞，而在网络攻击导致法国数百家超市被瘫痪之前。周日晚间，未知罪犯入侵了数千个控制器，将温度调高至122°F（50°C），导致食品变质，并在该国近700家超市引发火灾。法国国家网络安全局ANSSI周一警告称，涉及丹佛斯冷却控制器的广泛入侵事件正在发生，次日又补充称受影响的系统还包括科普兰及其迪克赛尔品牌。
Security researchers warned about exploitable vulnerabilities in refrigeration controllers months - and in one case, more than a year - before cyberattacks disrupted hundreds of French supermarkets. Late Sunday night, unknown criminals hacked thousands of controllers, cranking the heat as high as 122°F (50°C), spoiling food and sparking fires across nearly 700 of the country’s supermarkets. France's national cybersecurity agency ANSSI on Monday warned of widespread compromises involving Danfoss refrigeration controllers, and a day later added affected systems from Copeland and its Dixell brand.
这些被入侵的设备可通过互联网访问，据报道许多设备已不再接收软件或安全更新，而其他设备则运行着过时的固件。丹佛斯未能立即回应《The》的置评请求。科普兰向我们发送了以下声明：“我们承认在一款已停产、生命周期结束的控制器世代中发现了漏洞。保护客户的运营一直是我们的首要任务。我们目前正与受影响的客户合作以降低风险。我们将继续通过受支持的产品、当前软件和行业推荐实践，支持客户加强网络安全。”
The compromised devices were accessible over the internet, with many reportedly no longer receiving software or security updates and others running outdated firmware. Danfoss did not immediately respond to The’s request for comment. Copeland emailed us the following statement: “We acknowledge the vulnerability identified in a discontinued, end-of-life generation of controllers. Protecting our customers’ operations has always been a top priority. We are currently working with impacted customers to mitigate the risk. We will continue to support customers in strengthening cybersecurity through supported products, current software and industry-recommended practices.”
运营技术（OT）安全公司Claroty的Team82团队在八月就对这些存在缺陷的设备发出警报，称黑客可能“冻结控制器”和“解冻食品”。当时，研究人员公布了数十个漏洞的详情，包括身份验证绕过和操作系统命令执行缺陷，这些漏洞影响了丹佛斯AK-SM 800A和科普兰XWEB控制器。更早之前，美国网络安全和基础设施安全局（CISA）发布了关于两个品牌控制器安全漏洞的警告。
Operational technology (OT) security firm Claroty’s Team82 sounded the alarm on these buggy devices in August, warning that hackers could “freeze the controller” and “defrost the food.”At the time, the researchers published details of dozens of vulnerabilities, including authentication bypass and operating-system command execution flaws, affecting Danfoss AK-SM 800A and Copeland XWEB controllers. Even earlier, the US Cybersecurity and Infrastructure Security Agency (CISA) published advisories about security flaws in both brands’ controllers.
2月，CISA表示，Copeland XWEB和XWEB Pro的近两打个CVE可能被利用，以“允许攻击者绕过身份验证、导致拒绝服务状态、导致内存损坏以及执行任意代码”。在2025年5月的一份通报中，该通报在2025年8月更新，CISA发布了关于有缺陷的Danfoss AK-SM 8xxA系列设备的类似警告。“使此事件尤为引人注目的是时间线，”网络保险提供商Coalition的首席承保官Tiago Henriques对《The》表示。
In February, CISA said nearly two dozen CVEs in Copeland XWEB and XWEB Pro could be exploited to “allow an attacker to bypass authentication, cause a denial-of-service condition, cause memory corruption, and execute arbitrary code.”In a May 2025 advisory, updated in August 2025, CISA published a similar warning about buggy Danfoss AK-SM 8xxA series devices. “What makes this incident particularly striking is the timeline,” Tiago Henriques, chief underwriting officer at cyber insurance provider Coalition, told The.
他指出，法国超市被黑客入侵发生在Team82发布其研究之后两个月，而Danfoss发布了固件更新（R4.3.1）以缓解这些漏洞。“关键暴露”仍在持续“然而，尽管这些补丁可用，Coalition的扫描显示，这些威胁的关键暴露持续到了秋季，”Henriques说。在9月7日至10月6日期间，Coalition的传感器识别出1,506个仍公开暴露Danfoss StoreView可通过网络访问的管理面板的唯一IP地址，其中820个——占54%——与法国网络相关联。
He noted that the French supermarket hacks happened two months after Team82 published its research, and Danfoss released a firmware update (R4.3.1) to mitigate the flaws. 'Critical exposure' continues “Yet, despite the availability of these patches, Coalition’s scanning identified critical exposure to these threats continuing well into the fall,” Henriques said. Between September 7 and October 6, Coalition’s sensors identified 1,506 unique IP addresses still publicly exposing a Danfoss StoreView web-accessible admin panel, and 820 of these - 54 percent - were associated with French networks.
“我们的扫描统计显示，至少有2,624个来自所述品牌的制冷控制器的页面面向互联网开放：1,506个Danfoss StoreView和1,119个XWEB，”他补充道，并指出有一个IP同时运行这两种类型的控制器。需要明确的是：这并不意味着所有这些控制器都存在漏洞，而是它们暴露在公开互联网上。即使在网络攻击之后——截至周四——根据保险提供商的统计，仍有618台Danfoss设备连接到互联网。
“Our scans counted at least 2,624 refrigeration controllers from the named brands with a page open to the internet: 1,506 Danfoss StoreView and 1,119 XWEB,” he added, noting that one IP runs both types of controllers. To be clear: this doesn’t mean all of these controllers were vulnerable, but rather they were exposed to the open internet. Even after the cyberattacks - as of Thursday - 618 Danfoss devices remain connected to the internet, according to the insurance provider’s count.
其中，206台连接到法国网络，50台位于美国，2台位于英国。“具有可通过网络访问的管理面板的未修补设备可能成为数字攻击者的主要入口点，”Henriques说。
Of these, 206 are connected to French networks, while 50 are in the US, and two in the UK. “An unpatched device featuring a web-accessible admin panel can act as a major entry point” for digital attackers, Henriques said.
“要点很明确：数字风险远远超出工作站和电子邮件服务器的范围。”罪犯也在针对连接到互联网的OT和其他工业设备。“在被攻击之前识别这些暴露的访问点，可以直接有助于保障业务连续性，”亨利克斯说。OT网络负责人呼吁CISA发布指令在美国，一群OT网络安全和技术提供商进一步强化了他们对美国食品和农业领域加强防护的呼吁。
“The takeaway is clear: digital risk extends far beyond workstations and email servers.”Criminals are targeting OT and other industrial devices that are connected to the internet, too. “Identifying these exposed access points before they are targeted can directly contribute to preserving business continuity,” Henriques said. OT cyber leaders call for CISA directive In America, a group of OT cybersecurity and technology providers doubled down on their call for stronger food and agriculture protections in the US.
法国的网络攻击“再次鲜明地提醒人们，实施基线网络安全措施以提升运营技术网络安全的重要性，”运营技术网络安全联盟（OTCC）在周三的声明中表示。本月早些时候，该联盟的成员包括Claroty、Forescout、Honeywell和施耐德电气，曾呼吁CISA发布一项具有约束力的运营指令，以改善联邦政府内部的OT网络安全。
The French cyberattacks “are another stark reminder of the importance of implementing baseline cybersecurity measures to enhance operational technology cybersecurity,” the Operational Technology Cybersecurity Coalition (OTCC) said in a Wednesday statement. Earlier this month, the group, whose members include Claroty, Forescout, Honeywell, and Schneider Electric, called on CISA to issue a Binding Operational Directive to improve OT cybersecurity within the federal government.
OTCC在周三重申了这一诉求，并建议美国农业部可以鼓励食品和农业领域的组织实施网络安全最佳实践。“虽然美国尚未报告任何事件，但恶意行为者无疑正将此事件视为在此实施攻击的潜在途径，”声明称。“我们不能等到那时才行动。”®
The OTCC repeated this demand on Wednesday and suggested that the US Department of Agriculture could encourage organizations in the food and agriculture sector to implement cybersecurity best practices. “While no incidents have been reported in the United States, malicious actors are undoubtedly viewing this incident as a potential attack vector to perform here,” the statement said. “We cannot wait for that to happen.”®