What changed
Attackers compromised internet-connected refrigeration controllers at an estimated 700 supermarkets, forcing prolonged defrost cycles that pushed some refrigerators to 50°C (122°F). Food spoiled, electrical systems caught fire in some stores, and supermarkets in France were hit alongside reported cases in Spain, Portugal, Poland, Germany and Belgium.
The controllers came from Danfoss, Dixell and Copeland. Several models had outdated firmware or known vulnerabilities that could give remote users administrator-level access. Copeland acknowledged a flaw in discontinued, end-of-life controllers.
Why it matters
This was not an exotic attack on a mysterious machine. It was a basic security failure attached to physical infrastructure.
The controllers were apparently reachable from the public internet without the usual safeguards: a VPN, an IP allowlist, current firmware and changed credentials. In Danfoss systems, some devices used a daily password generated from the date in publicly available firmware. The same passwords could work across models in hundreds or thousands of stores.
That turns one neglected controller into a possible master key. A supermarket operator can lose its cold chain without its checkout systems going down or its doors being forced open. The result is spoiled inventory, disrupted stores and potentially tens or hundreds of millions of euros in losses.
The practical lesson is uncomfortable but clear: connected equipment still needs ownership, patching and access controls after installation. Researchers had warned about these weaknesses before the incident, and French authorities are now dealing with the consequences of treating refrigeration as a maintenance problem rather than an internet-facing computer system.
Comments
No comments yet.