Supermarket Fridge Hack Driven by Poor Security Practices
A recent mass cyberattack exploiting outdated internet-connected refrigeration controllers at hundreds of supermarkets has caused millions in damages, extensive food spoilage, and fires across multiple European countries.
Radwan AbdulhadiEditor and technology writer
Mass Supermarket Hack Causes Fires and Spoiled Food
Earlier this week, a mass cyberattack targeted refrigeration systems at an estimated 700 supermarkets throughout France, causing them to suddenly malfunction. The incident resulted in the spoilage of untold tons of perishable goods and, in some cases, dangerous electrical fires. According to reports cited by outlets like estimated, the attack exploited internet-connected controllers that technicians normally use to remotely administer store-wide refrigeration fleets.
French authorities reported that unknown attackers accessed these systems and activated the internal defrosters long enough for the refrigerators and freezers to reach temperatures as high as 50° Celsius (122° Fahrenheit). By the time the massive compromise was identified and addressed, food supplies had perished and electrical infrastructure within some units had caught fire. In addition to France, Spain, Portugal, Poland, Germany, and Belgium were also reportedly affected by the sweep.
Critical Vulnerabilities in Industrial Controllers
Multiple security advisories and public research reports indicate that all three controller models targeted in the incident—manufactured by Denmark-based Danfoss and US-based Dixell alongside its parent company Copeland—contained critical security flaws. These vulnerabilities allowed remote attackers to log into the devices with the exact same system rights as authorized administrators.
For instance, Danfoss controllers previously relied on a daily credential generated by publicly available firmware based on the calendar date. Analysts noted that anyone willing to analyze the firmware code could calculate the identical daily password across models installed in hundreds or thousands of stores. Similar remote access flaws were also fixed in Copeland and Dixell controllers over the past few months, as detailed in reports such as Multiple and advisories.
Lack of Basic Cyber Hygiene Enabled the Attack
Beyond running industrial controllers with outdated firmware, the impacted supermarkets failed to implement foundational network protections. Experts noted that these devices were likely left directly exposed to the public internet without being placed behind a VPN or restricted by an IP address allowlist. Security commentators have pointed out that a simple lack of basic cyber hygiene directly caused the incident, which likely accumulated tens or hundreds of millions of euros in damages.
Researchers at Pen Test Partners outlined how the breach could have been entirely averted, observing that attackers do not need sophisticated state-sponsored capabilities to manipulate temperature controls when devices are left unprotected, as discussed in their analysis on said. Similar warnings had been issued previously, including research published last October by Claroty regarding vulnerabilities in Danfoss refrigeration controllers, as well as an alert issued by the US Cybersecurity and Infrastructure Security Agency that did the same in February.
Industry Response and Unclear Motives
In email statements following the incidents, Copeland acknowledged that a vulnerability was identified in a discontinued, end-of-life generation of controllers and confirmed that the company is actively working with customers to prevent future occurrences. Danfoss representatives did not immediately respond to media inquiries, though reports noted the company also pointed toward discontinued hardware models.
Because the party responsible for the mass hack has remained completely silent, investigators are weighing several potential motives. Theories range from large-scale acts of digital vandalism to coordinated operations by international actors aiming to induce continent-wide infrastructure disruption. Technology journalists tracking the fallout, such as Dan Goodin, have continued following updates and community discussions on platforms like here and here.
Broader Lessons for Corporate Security
The massive European refrigeration hack highlights an ongoing tension between the financial and security departments within modern businesses. Corporate leadership teams are frequently reluctant to allocate substantial budgets toward upgrading operational technology equipment when tangible cost savings are not immediately obvious.
Industry observers emphasize that organizations often wait for a catastrophic breach before recognizing the value of proactive infrastructure investments. While executives at the affected supermarket chains are expected to take away rigorous lessons from the disaster, it remains uncertain whether this cautionary tale will prompt widespread security changes across other industries.
Sources
- Ars TechnicaFridge hack costing millions and sparking fires stemmed from poor security
Continue chronologically
Related stories
Refrigeration Controller Hack Spoils European Food
A sophisticated cyberattack targets Danfoss refrigeration controllers, raising temperatures in hundreds of European supermarkets and spoiling fresh food.
Fresh Cyberattacks Hit Supermarket Refrigerators in Europe
A second wave of suspected cyberattacks has targeted supermarket refrigerators across Europe, causing widespread food spoilage and supply disruptions.
CISA Adds Node2Shell Flaw to KEV as Honeypots Log Attacks
CISA has added the Node2Shell Brotli vulnerability to its KEV catalog as security firms record initial exploitation attempts and major vendors issue patches.
CISA Confirms Active Exploitation of PHP2Shell Flaws
CISA adds critical PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog and orders federal agencies to patch systems quickly.
