Fridge hack costing millions and sparking fires stemmed from poor security

A mass cyberattack compromised Internet-connected refrigeration systems across an estimated 700 French supermarkets this week. French authorities reported that the sudden malfunctions ruined untold tons of perishable food and sparked electrical fires in several locations. The unknown attackers targeted internet-connected controllers used by technicians to remotely manage store-wide fleets of refrigerators and freezers.

By exploiting these devices, the intruders forced defrosters to run until internal temperatures reached 50 degrees Celsius, or 122 degrees Fahrenheit. Public research reports and security advisories indicate that the incident involved three specific controller models sold by Danish manufacturer Danfoss and US-based Copeland and its subsidiary Dixell. These devices contained critical vulnerabilities that let unauthorized users log in with full administrative rights.

For example, older Danfoss controllers relied on a predictable daily password generated by public firmware based on the current date. Because these daily credentials were identical across thousands of stores, attackers who analyzed the code could easily access any unpatched device.