CERT-FR named four controller families in its alert: Danfoss AK-SM, Danfoss AK-SC, Copeland XWEB and Dixell XWEB. Put those names into an internet search engine and the results split apart immediately.

Four names, four different answers

A ZoomEye session on 21 October 2026 returned 271 assets for title="StoreView Web", 2 for title="AK-SM", and 46,263 for title="XWEB". An application fingerprint query, app="StoreView", returned 0.
Only one of those numbers describes the estate the alert is about. The rest describe either a narrow slice of it or something unrelated.

Why the label and the banner diverge

A vendor's marketing name is written for buyers. The banner on the device is written by firmware engineers and may use a product-family name, a model code, or a generic title. Danfoss refrigeration controllers, for example, present a StoreView interface, which is a management layer name rather than a controller model.
A useful handle is whatever string the device itself emits. That is a discovery task, not a lookup.

A short procedure

  • Search the family name broadly, then inspect several returned banners.

  • Extract repeated strings and test them as title, product or app values.

  • Keep only the fingerprint whose matches you can describe without hedging.

  • Record the exact syntax, so the next measurement is comparable.
    Do not borrow a fingerprint from a different product line because it produced a bigger number.

What this means for the incident

The exposed population that can be measured confidently is the StoreView layer, at 271 assets globally. That does not mean only 271 refrigeration controllers are reachable; it means 271 advertise that interface. Smaller figures for AK-SM and larger figures for a four-letter XWEB token are artefacts of naming, not statements about risk.

References

  • CERT-FR alert CERTFR-2026-ALE-012: https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/

  • SecurityWeek, supermarket refrigeration attack coverage: https://www.securityweek.com/supermarket-refrigeration-attack-widens-to-copeland-dixell-controllers/

  • ZoomEye queries executed 21 October 2026.