Hackers Exploit Unpatched Refrigeration Controllers to Disrupt 700 European Supermarkets
Attackers compromised internet-connected cooling systems across Europe, causing massive food spoilage and fires by exploiting known vulnerabilities in outdated hardware.
Key points
- An estimated 700 supermarkets across Europe suffered refrigeration failures after attackers compromised internet-connected controllers.
- The incident caused tons of perishable food to spoil and sparked fires in some locations, with costs reaching hundreds of millions of euros.
- Vulnerabilities in devices from Danfoss, Dixell, and Copeland allowed remote administrative access due to outdated firmware and poor network segmentation.
Attackers compromised internet-connected refrigeration controllers at an estimated 700 supermarkets across Europe earlier this week, causing widespread system malfunctions. According to French authorities, the breach resulted in significant food spoilage and electrical fires after hackers manipulated defroster settings to raise internal temperatures to 50 degrees Celsius.
The attackers targeted controllers that allow technicians to remotely administer store-wide cooling fleets. By activating defrosters for extended periods, they forced refrigerators and freezers to reach critical heat levels. This manipulation occurred before the compromise was detected, leading to the destruction of untold tons of perishable goods and damage to electrical systems in multiple locations.
Technical Vulnerabilities and Attack Vector
The incident exploited critical vulnerabilities in controller models sold by Danfoss of Denmark, as well as Dixell and its parent company Copeland in the United States. Public research reports and security advisories indicate these devices contained flaws allowing remote login with full administrative rights. These vulnerabilities had been identified and addressed in updates released in the months preceding the attack.
Danfoss controllers previously used a daily rotating credential generated by publicly available firmware based on the current date. Attackers who analyzed the code could replicate this password generation process on any device lacking recent updates. Because the daily passwords were identical across models in hundreds of stores, this design flaw facilitated mass exploitation without unique credentials for each unit.
Operational Failures and Financial Impact
Beyond running outdated firmware, affected supermarkets likely failed to implement standard network security measures. According to Ars Technica, the stores probably did not place these devices behind a virtual private network or restrict login access to specific IP addresses. These basic protections are common industry standards but were apparently ignored in this case.
The financial toll of the breach is estimated in the tens or hundreds of millions of euros. The impact was felt across multiple nations, including France, Spain, Portugal, Poland, Germany, and Belgium. Researchers at Pen Test Partners noted on Wednesday that two specific security measures would have altered the outcome of this widespread intrusion.
What should you do?
Organizations should audit their industrial control systems for known vulnerabilities and ensure firmware is updated to the latest secure versions. Network administrators must verify that remote management interfaces are not directly exposed to the public internet without additional authentication layers. Monitoring logs for unusual command executions can help detect unauthorized access attempts before physical damage occurs.
What to do and how to stay safe: Danfoss
- Review inventory of industrial IoT devices to identify any running outdated firmware with known remote access vulnerabilities.
- Ensure all remote management interfaces are placed behind a VPN and restricted to a whitelist of trusted IP addresses.
- Monitor system logs for anomalous command executions, such as unexpected defroster activations or temperature changes.
- Verify that vendor-provided security patches are applied promptly once released to mitigate critical administrative access flaws.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which companies manufactured the compromised refrigeration controllers?
The affected controllers were sold by Danfoss of Denmark, and Dixell along with its parent company Copeland in the US.
How did the attackers gain access to the systems?
Attackers exploited critical vulnerabilities in outdated firmware that allowed remote login with administrative privileges, often using predictable daily passwords.
What security measures could have prevented this breach?
Implementing a VPN for remote access and restricting login permissions to specific IP addresses would have likely prevented the mass compromise.
