Most security teams have a playbook for a compromised server and none for a compromised refrigerator. The CERT-FR alert shows what the first hours look like when the assets are cold-chain controllers, and the sequence differs from a typical host incident.

Hour one: confirm scope without touching the plant

Before isolating anything, establish what the site actually runs. A controller family from Danfoss, Copeland or Dixell, with a model and firmware version, is the minimum. CERT-FR's alert names AK-SM and AK-SC on the Danfoss side and XWEB on the Copeland and Dixell side.
Removing a controller from the network protects the network. It may also disable temperature control if the unit has no local fallback, so facilities engineering must be in the call from the start.

Hour one to three: cut the public path

CERT-FR advised operators to take affected controllers off the internet and restore remote access only through a secure VPN or a protected network. The agency also said filtering connections by IP address is acceptable only as a temporary emergency measure.
That is a direct instruction about sequence. Blocking at the perimeter first is fast and reversible. Re-architecting remote access comes later.

Three to twenty-four hours: look for the pattern

The reported behaviour was control-mode manipulation rather than data theft. According to Le Monde, attackers kept some units in defrost mode for up to eight hours, which delayed alarms. Review controller logs for mode changes outside the site's schedule, silenced alarms, and configuration edits that widened thresholds.
Two supermarkets in Alsace reported combined losses of €270,000, so the cost of missing this pattern is material.

Day one to week one: verify, do not assume

A factory reset is not remediation for an exposed end-of-life device. CERT-FR states that the device will remain vulnerable and is likely to be compromised again if it stays exposed. Replacement or permanent network isolation are the real fixes.
Use an external count as a completeness check. ZoomEye query for title="StoreView Web" on 21 October 2026 returned 271 assets globally, 55 in France, and smaller counts in the Netherlands, Germany and Belgium.

The rule that generalises

Every step above is a network or process control, not a signature. That is what makes it usable before attribution is settled.

References

  • CERT-FR alert CERTFR-2026-ALE-012: https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/

  • SecurityWeek, supermarket refrigeration attack coverage: https://www.securityweek.com/supermarket-refrigeration-attack-widens-to-copeland-dixell-controllers/

  • ZoomEye query executed 21 October 2026.