Hack of Refrigeration Controllers at 700 French Supermarkets Causes Spoilage and Fires

The unknown attackers activated defrosters long enough for the fridges to reach temperatures as high as 50 degrees Celsius (122 degrees Fahrenheit), Ars Technica reported. By the time the mass compromise was discovered, food was spoiled and in some cases electrical systems had caught fire. The report said basic cybersecurity would have prevented the incident.

Multiple security advisories and public research reports show that all three of the controller models reportedly hacked in the incident contained critical vulnerabilities that allow attackers to remotely log in to the devices with the same system rights as administrators, according to Ars Technica. The controllers were sold by Danfoss of Denmark and by Dixell and its parent company Copeland in the United States.

Until recently, Danfoss controllers used a credential that changes each day, Ars Technica reported. The password is generated by publicly available firmware based on the date. A hacker who takes the time to analyze the code can do the same thing on any device that has not received a recent update. Daily passwords are identical across models located in hundreds or thousands of stores, the report said.

The attackers were described as unknown. Ars Technica did not specify how many stores suffered fires or the exact total financial loss, but its headline described the hack as costing millions. The report also did not include comment from Danfoss, Dixell or Copeland.