Seven hundred supermarkets hacked in France

Unknown attackers compromised internet-connected refrigeration controllers at an estimated seven hundred supermarkets throughout France, causing the systems to malfunction suddenly.

Defrosters activated, food spoiled and fires started

The attackers activated defrosters long enough for fridges to reach temperatures as high as fifty degrees Celsius, or one hundred twenty-two degrees Fahrenheit. Food spoiled and electrical systems caught fire.

Three controller models had known critical flaws

All three controller models reportedly hacked, sold by Danfoss of Denmark and Dixell and its parent company Copeland in the US, contained critical vulnerabilities allowing remote login with administrator rights.

Daily passwords identical across hundreds of stores

Danfoss controllers used credentials that change each day, generated by publicly available firmware based on the date. A hacker analyzing the code could generate the same password for any unpatched device.

Standard protections were not in place

Affected stores likely failed to put devices behind a VPN, create restricted IP address lists, or patch to current firmware. These protections are standard but often not followed in practice.

“Two things would have changed the outcome. Cyber hygiene would have prevented the access: take the controller off the public internet, put remote access behind a VPN and an IP allowlist, bring third-party kit onto the network in a controlled, owned and documented way rather than leaving it on a contractor's own connection, change known and default credentials, and patch to a current release.”

Attack cost tens or hundreds of millions of euros

The mass hack likely cost tens or hundreds of millions of euros. Spain, Portugal, Poland, Germany and Belgium were also reportedly affected. The attacker's motive remains unknown.