Default Credentials Expose Copeland Refrigeration Controller to 743 Parameter Changes

Attackers used default administrator credentials to compromise an internet-exposed Copeland XWEB Pro 1.9.0 refrigeration supervisory controller at an anonymized commercial site overnight on November 1–2, 2026, Ransom-ISAC reported. Two external administrator sessions recorded 743 parameter writes across 31 refrigeration devices, including extreme temperature setpoints, altered alarm thresholds and defrost settings, and commands intended to silence alarms and restrict local keypad operation. The logs document configuration changes but do not establish whether they took effect, what temperatures were reached, whether safety mechanisms intervened, or whether equipment damage or stock losses occurred.

The installed firmware reportedly contained two critical vulnerabilities patched in February 2026, but default credentials—not exploitation of those vulnerabilities—were identified as the entry method. No ransomware or malware was identified, and no evidence links the incident to NoName057(16), Z-Pentest Alliance, or other reported refrigeration attacks in Europe. Operators should remove public access to management interfaces, replace default credentials, apply model-specific firmware updates, monitor configuration changes, and independently verify temperatures rather than relying solely on potentially altered supervisory readings.