Earlier this week, cybersecurity attacks targeted refrigeration management systems across an estimated 700 supermarket locations in France, with additional incidents reported in Spain, Portugal, Poland, Germany, and Belgium. The compromised systems consisted of internet-connected controllers manufactured by Danfoss, Dixell, and Copeland that manage store-wide networks of refrigerators and freezers. Unknown attackers gained access to these devices and remotely activated defrosting functions, causing internal temperatures to reach approximately 50 degrees Celsius, resulting in widespread food spoilage and, in certain instances, electrical fires that caused property damage.
Security researchers identified that the controller models involved contained critical vulnerabilities that allowed attackers to obtain administrative-level access to the systems remotely. Danfoss controllers, for example, utilized daily-changing credentials generated from publicly available firmware based on the calendar date. An attacker with knowledge of the underlying code could replicate these passwords across multiple devices. Similar vulnerabilities affecting Copeland and Dixell controllers were addressed only in recent months through security patches. The incident likely resulted in financial losses totaling tens or hundreds of millions of euros.
The successful attack exploited common cybersecurity oversights at the affected retail locations. Stores had failed to implement standard protective measures, including placing controllers behind virtual private networks, maintaining IP address whitelists to restrict access, updating firmware to current versions, and changing default credentials. Security researchers from Pen Test Partners and the firm Claroty, along with the US Cybersecurity and Infrastructure Security Agency, had previously published warnings about these specific vulnerabilities and recommended basic defensive practices.
Both Copeland and Danfoss acknowledged the compromised systems involved discontinued or end-of-life equipment models and indicated they are collaborating with affected customers to prevent future incidents. The identity and motivations of the attackers remain unknown, leaving open the possibility that the incident represented either large-scale vandalism or a coordinated disruption operation by a state actor or international group. The incident highlights ongoing challenges companies face in prioritizing cybersecurity investments when financial departments perceive limited immediate benefits relative to equipment modernization costs.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI