Authorities in France say attackers compromised internet-connected controllers that technicians use to remotely manage store-wide refrigerator and freezer fleets, then ran defrosters until the units reached temperatures as high as 50 degrees Celsius (122 degrees Fahrenheit). Food spoiled before the mass compromise was discovered, and in some cases the appliances' electrical systems caught fire. Officials attribute the damage to weak security on the devices.
Security advisories and public research reports indicate that all three controller models reportedly involved were vulnerable to remote login with administrator-level rights. The models are sold by Danfoss of Denmark and by Dixell and its parent company Copeland in the US. Danfoss controllers, for example, had until recently relied on a credential that changes daily, generated by publicly available firmware based on the date. Anyone who studied that code could produce the same password for any device that had not been updated recently, and daily passwords were identical across models in hundreds or thousands of stores. A set of critical flaws fixed in recent months in Copeland and Dixell controllers also grants similar remote access.
The affected stores also likely left the devices exposed by failing to place them behind a VPN or to restrict which IP addresses may log in, protections that are standard but frequently skipped. That lapse enabled a mass hack that likely cost tens or hundreds of millions of euros, according to the report. Spain, Portugal, Poland, Germany, and Belgium were also reported to be affected.
Researchers at Pen Test Partners said the outcome would have differed if basic cyber hygiene had been followed: keeping the controller off the public internet, placing remote access behind a VPN and an IP allowlist, onboarding third-party equipment through a controlled, owned and documented process instead of leaving it on a contractor's connection, changing known and default credentials, and patching to a current release. Claroty researchers flagged the danger of skipping those steps last October, and the US Cybersecurity and Infrastructure Security Agency did the same in February.
In an email, Copeland acknowledged a vulnerability identified in a discontinued, end-of-life generation of controllers and said it is working with customers to prevent similar incidents. Danfoss representatives did not immediately respond to questions; CNN reported that the company also cited discontinued models.
No party has claimed responsibility, leaving open the possibility that the motive was large-scale vandalism or that a nation-state or other international actor sought continent-wide disruption. The episode highlights the friction between financial and security departments at businesses reluctant to spend heavily on new equipment without tangible returns. Whether the example will influence other businesses is less clear.
More cybersecurity news from TechManNews.
