Hack of fridge controllers at 700 French supermarkets caused fires, spoilage

A mass hack of refrigeration systems across an estimated 700 supermarkets in France left stores dealing with spoiled food and, in some cases, fires, according to Ars Technica. French authorities say the attackers targeted the internet-connected controllers that technicians use to remotely administer each store's fleet of refrigerators and freezers. Once inside, the intruders switched on defrosters long enough to drive temperatures as high as 50° Celsius (122° Fahrenheit). The compromise was only discovered after perishables had already been ruined and some electrical systems had ignited.

The incident illustrates how a single class of networked building equipment can be turned against the businesses that rely on it. Rather than disabling cooling outright, the attackers abused a normal maintenance function, running defrost cycles far beyond their intended duration. Because the affected controllers are managed remotely, the disruption could be pushed across many locations without anyone physically touching the hardware.

The controller models reportedly involved were sold by Danfoss of Denmark and by Dixell and its parent company Copeland in the United States, Ars Technica reports. Multiple security advisories and public research reports cited by the outlet show that all three models contained critical vulnerabilities allowing attackers to log in remotely with the same system rights as administrators. That level of access would let an intruder change operating parameters directly.

One recurring weakness was in how credentials were handled. Until recently, Danfoss controllers relied on a password that changes every day, generated by publicly available firmware based on the date. Anyone willing to study that code can reproduce the same daily password on any device that has not received a recent update, and those daily passwords are identical across models installed in hundreds or thousands of stores.

Ars Technica notes that basic cybersecurity practices would have prevented the episode, a pattern it describes as increasingly typical for connected operational equipment. It is not clear who carried out the attack or what motivated it. Stores affected by the malfunction faced losses from discarded inventory and repairs to damaged electrical components.