Refrigeration control systems at an estimated 700 supermarkets throughout France were compromised earlier this week in a coordinated cyberattack that resulted in significant financial losses and property damage. The incident affected Internet-connected controllers manufactured by Danfoss, Dixell, and Copeland that manage store-wide refrigeration networks. Once infiltrated, attackers remotely activated defrost functions, causing temperatures to reach approximately 50 degrees Celsius, which led to extensive food spoilage and in certain locations, electrical fires that posed additional hazards.
Security researchers identified that the compromise exploited critical vulnerabilities present in all three controller models involved. Danfoss systems historically relied on daily-changing passwords generated from publicly available firmware code, allowing analysts to replicate authentication credentials on any unpatched device. Similar remote access vulnerabilities were recently remediated in Copeland and Dixell controller models after having persisted for extended periods. Beyond firmware vulnerabilities, the affected retailers apparently failed to implement standard protective measures such as virtual private networks or IP address whitelisting to restrict access to these devices.
Experts from Pen Test Partners and security firm Claroty had previously warned of such risks. The Cybersecurity and Infrastructure Security Agency also issued guidance on these threats in February. Both emphasized fundamental cybersecurity practices including taking controllers offline from public Internet access, implementing VPN protections, maintaining updated credentials, and deploying current firmware versions across all systems. Reports indicate that Spain, Portugal, Poland, Germany, and Belgium experienced similar incidents.
Manufacturers have begun responding to the incident. Copeland acknowledged vulnerabilities in discontinued controller generations and stated the company is collaborating with customers on preventive measures. The identity of the attackers remains unknown, leaving open questions about whether the motivation was large-scale vandalism or disruption by a nation-state actor. The incident highlights an ongoing organizational challenge: balancing cybersecurity investments against perceived immediate financial benefits, with many companies deferring equipment upgrades until catastrophic breaches force reconsideration.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI