A mass breach of cooling systems in approximately 700 supermarket stores in France disrupted refrigerators and freezers, with temperatures inside some of them rising to 50 degrees Celsius. This resulted in damage to unspecified quantities of food and fires in some electrical systems.
The attackers targeted internet-connected control units that allow technicians to manage store cooling systems remotely. After compromising them, they activated defrost functions for extended periods, causing temperatures to rise instead of maintaining the cold chain. Effects linked to the incident were also reported in Spain, Portugal, Poland, Germany and Belgium.
Known vulnerabilities in outdated devices
According to research reports and public security advisories, the affected devices included models from Denmark-based Danfoss, Dixell and its US-based parent company Copeland. Until recently, some models of Danfoss units used a daily password generated based on the date within firmware available for analysis. Because the password was identical across models installed in hundreds or thousands of stores, it could be reproduced on devices that had not received a recent update.
Copeland and Dixell units also contained critical vulnerabilities that were fixed during the past few months, and they allowed remote access with privileges similar to those of administrators. This indicates that the problem was not remote connectivity itself, but operating outdated devices while leaving them accessible from the public internet.
What could practically have been prevented?
Researchers from Pen Test Partners said that basic measures could have changed the outcome of the incident, including removing control units from the public internet, placing remote access behind a VPN and a list of permitted IP addresses, changing known or default credentials, and updating the software to current versions.
The researchers also stressed the need to bring third-party equipment onto the organization’s network in a documented manner and under its control, rather than leaving it connected through a connection belonging to an external contractor. Claroty had warned of the risks of ignoring these measures last October, while the US Cybersecurity and Infrastructure Security Agency, CISA, issued a similar warning in February.
The responsible party and unanswered lessons
The party behind the attack has not claimed responsibility, so its motives remain unresolved between large-scale sabotage and the possibility that an international or government actor carried out a cross-border disruption operation. Copeland acknowledged a vulnerability in a discontinued and end-of-support generation of control units and said it was working with customers to prevent similar incidents. Danfoss did not immediately respond to Ars Technica’s questions, with discontinued models also having been part of the discussion.
The incident is significant because it illustrates how a small industrial device, if managed with outdated software and exposed access, can become a point of direct operational impact on inventory and facility safety. However, the source does not determine the number of compromised devices or the final value of the losses, nor does it establish the attacker’s identity or motive so far.