Massive Supermarket Fridge Hack Exploits Outdated Security, Causing Fires and Spoilage

Image: Ars Technica · Source

A widespread hack of refrigeration systems in 700 European supermarkets exploited outdated internet-exposed controllers, causing food spoilage and fires. Experts attribute the incident to poor cybersecurity practices and unpatched vulnerabilities.

In a significant cybersecurity incident this week, refrigeration systems across approximately 700 supermarkets in France experienced a coordinated hack that resulted in widespread food spoilage and, in some cases, fires. The attack targeted Internet-connected controllers responsible for remotely managing entire fleets of refrigerators and freezers within the stores. By exploiting these devices, attackers activated defrosters causing temperatures to soar as high as 50° Celsius (122° Fahrenheit), leading to considerable damage before detection.

French authorities indicate that the compromised devices were made by Danfoss of Denmark and Dixell, along with its parent company Copeland based in the United States. These controllers were found to have critical vulnerabilities that allowed attackers remote administrator-level access. Notably, Danfoss controllers used a daily-changing credential generated by publicly available firmware based on the date — a mechanism that hackers could replicate to gain unauthorized access, especially on devices lacking recent firmware updates. Similarly, recent fixes in Copeland and Dixell controller firmware addressed comparable remote access vulnerabilities.

Experts highlight that the affected stores operated with outdated firmware and neglected established cybersecurity measures such as removing devices from public Internet exposure, implementing VPNs, enforcing strict IP address allowlists, and replacing default credentials. These lapses facilitated a massive breach likely costing tens to hundreds of millions of euros. Other European countries reportedly affected include Spain, Portugal, Poland, Germany, and Belgium.

Security specialists from Pen Test Partners emphasized that adherence to basic cyber hygiene could have entirely averted the attack. They stressed the importance of controlled network integration for third-party equipment and maintaining current software versions. Prior warnings about such risks were issued by security firm Claroty last October and reiterated by the US Cybersecurity and Infrastructure Security Agency in February.

Copeland acknowledged a vulnerability in an end-of-life generation of controllers and is engaging with customers to mitigate future risks. Danfoss did not immediately respond to inquiries, but reports indicate that similarly discontinued models were implicated.

The attackers have yet to claim responsibility, leaving motives uncertain. Possibilities include large-scale vandalism or interference by state or international actors aiming for wide disruption.

This event highlights the ongoing tension between corporate financial constraints and security investments. Many organizations resist upgrading equipment without direct financial incentives, only to face significant operational and reputational damage later. Supermarket chains impacted will confront costly repercussions, but it remains uncertain whether this incident will prompt broader changes in industry cybersecurity practices.