Most cyberattacks steal data or lock files. These ones spoiled food. Over the past month, attackers logged into the controllers that run commercial refrigeration in European supermarkets and turned the cold rooms into ovens. The equipment involved is the same kind that sits in restaurant kitchens, grocery stores, food warehouses and pharmacies everywhere, often connected to the internet so a technician can check it remotely.
What happened
On the night of 11–12 October, refrigeration in hundreds of French supermarkets started to warm up. Attackers had changed the settings on the stores' refrigeration controllers, forcing evaporators into defrost and in some cases setting temperatures as high as 50°C. In some stores the units ran hot for about six hours before staff noticed. France's finance minister told parliament about 700 of the country's roughly 10,000 supermarkets were affected. The Paris prosecutor opened an investigation into damage that included reported fires.
France's national cyber agency, through its alert service CERT-FR, named the equipment involved: Danfoss AK-SM and AK-SC system managers, and Copeland and Dixell XWEB controllers. Many of the units hit were older models that no longer receive updates, and the agency's central finding was simple: their management interfaces had been put on the internet. Copeland acknowledged a flaw in a discontinued generation of its controllers.
The attacks resumed on the night of 1–2 November, this time against more than 100 stores across Europe, from Delhaize in Belgium and SuperValu in Ireland to Intermarché in Portugal and independent butchers in the Netherlands. The researcher Kevin Beaumont found that every affected freezer he could identify had a management interface reachable from the internet. Danfoss had told customers in mid-October to disconnect them. A decoy system run by the security firm Lupovis recorded attempts to log in using Danfoss's publicly documented factory passwords in the days before.
The same night, cold rooms holding plasma at three sites of the Établissement français du sang, France's national blood service, were set to very high temperatures through its refrigeration contractor's remote monitoring software. An on-call technician saw the temperatures rising in the night, products were moved, and the blood service says no health impact has been identified.
The US warning
On 5 November, CISA, the FBI, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation published a joint fact sheet. They said they are "aware of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally," aimed at temperature and refrigeration controllers in grocery stores and cold storage, and that attackers "may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles."
The fact sheet names no brands and no specific US incidents. It lists the sectors at risk as healthcare, food and agriculture, chemicals and transportation, including refrigerated trucks, and warns of fire hazards and of losing visibility of current temperatures, not only of spoiled stock.
Why a small business should care
This equipment is everywhere. Walk-in coolers, display cases, blast chillers and pharmacy refrigerators are increasingly managed by controllers with a web page, so the installer or refrigeration contractor can check alarms from their phone. Many businesses do not know that page exists, let alone that it is on the internet.
The way in was the oldest one there is. No sophisticated exploit was needed for most of these attacks. An internet-facing login page, a factory password published in the manual, and nobody watching. That is the same pattern we described in the Zyxel switch attacks this week, where more than half the compromised devices still had default passwords.
The damage is physical and immediate. A cold room at 50°C for six hours means discarded stock, possible food-safety violations, and for a clinic or pharmacy, lost medicines. Insurance may not cover it, and nothing can be restored from a backup.
Alarms worked where they existed. The blood service lost nothing because a temperature alarm reached a person who acted on it in the middle of the night. That is the cheapest defense on this list.
What to actually do
Find out how your refrigeration is monitored. Ask your refrigeration contractor a direct question: do any of our controllers, system managers or monitoring panels have a web interface, and can it be reached from the internet? Get the answer in writing.
Take them off the internet. If remote access is needed, it should go through a VPN or a secure remote-access service, not an open web page. The US agencies' first recommendation is to eliminate public internet exposure entirely.
Change the default passwords. On every controller, and on the contractor's monitoring account. If you use Danfoss system managers, ask your contractor about the stricter security mode CERT-FR recommended.
Replace controllers that no longer get updates. Several of the models hit are end of life. If yours is one, plan the replacement, and until then it must not be reachable from the internet at all.
Set temperature alarms that reach a person. Define the acceptable range for every unit and make sure an alert goes to someone's phone at night, not only to a panel in an empty store. Consider an independent temperature sensor that does not depend on the controller itself.
Separate the network. Refrigeration, building management and camera systems should sit on their own network, apart from the office computers and the guest Wi-Fi.
The summary
Hundreds of European supermarkets lost their stock because refrigeration controllers were left on the internet with factory passwords, and the attackers came back a second time three weeks later for the ones that still were. Five US agencies have now told American businesses to check theirs.
For a restaurant, grocer, distributor or clinic, the work is small and specific: one question to your refrigeration contractor, a password change, and a temperature alarm that wakes someone up.
Sources
- US government partners urge hardening industrial refrigeration and cold chain monitoring systems — CISA, FBI, HHS, USDA and DOT
- Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération — CERT-FR
- Cyberattack targeting refrigeration systems hits 700 supermarkets, French government says — Associated Press
- Refrigeration controller hack spoils food across European supermarkets — SecurityWeek
- Over 100 European stores hit as supermarket fridge attacks resume — SecurityWeek
- Cyberattack disrupts blood storage refrigeration systems in France — BleepingComputer
- Une cyberattaque touche des installations frigorifiques utilisées par l'Établissement français du sang — franceinfo
- CISA and FBI warn of cyberattacks on refrigeration systems — The Record
- Pro-Russian hackers claim responsibility for attack on supermarket refrigeration systems — RetailDetail
- European refrigerator controller redux: a new wave of refrigeration attacks — Censys
