Earlier this week, refrigeration systems at an estimated 700 supermarkets throughout France were compromised in a coordinated cyberattack, resulting in massive food spoilage and multiple fire incidents. The attack targeted Internet-connected controllers that manage store-wide refrigeration fleets, allowing technicians to administer systems remotely. Attackers activated defrosters remotely, causing internal temperatures to reach 50° Celsius (122° Fahrenheit), which destroyed perishable inventory and in some instances triggered electrical fires. The incident also affected supermarkets in Spain, Portugal, Poland, Germany, and Belgium.
The vulnerable systems involved three controller models manufactured by Danfoss of Denmark and Dixell and its parent company Copeland in the United States. Security researchers identified that all three models contained critical vulnerabilities allowing remote administrative access. Danfoss controllers employed a password generation system based on the date, which could be reverse-engineered by attackers who analyzed publicly available firmware. Similar critical vulnerabilities in Copeland and Dixell controllers were patched only recently. The affected supermarkets compounded these vulnerabilities by operating outdated firmware versions and failing to implement standard protective measures such as placing controllers behind virtual private networks or restricting access through IP address whitelisting.
Experts emphasized that fundamental cybersecurity practices would have prevented the incident entirely. Standard protective steps include removing controllers from public internet access, implementing VPN-based remote access with IP allowlists, managing third-party equipment through controlled network onboarding, changing default credentials, and applying current security patches. Security firm Claroty had warned of these exact threats in October of the previous year, and the U.S. Cybersecurity and Infrastructure Security Agency issued similar guidance in February.
The financial impact is estimated at tens or hundreds of millions of euros. The identity of the attackers remains unknown, leaving open the possibility of either large-scale vandalism or a coordinated effort by a nation-state or international actor seeking to create widespread disruption. Copeland acknowledged the vulnerability existed in discontinued controller models and stated the company is collaborating with customers to prevent future incidents. The breach highlights ongoing tensions within businesses between financial and security departments, as executives often resist spending on infrastructure improvements until after major security failures occur.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI