Reported Freezer-Control Hacks Disrupted About 700 French Supermarkets
Summary
A reported Oct. 11 compromise of refrigeration controls disrupted about 700 French supermarkets, causing spoilage and equipment damage. Internet-accessible Danfoss controllers with default credentials were cited as an exposure, but investigators have not confirmed the ḁ
Key points
- An unknown attacker reportedly compromised refrigeration controls on Oct. 11, triggering extended defrost cycles in about 700 French supermarkets.
- The incident reportedly caused millions of euros in damage, spoiled food, damaged equipment and, in some cases, fires.
- The article names Danfoss controllers and Dixell and Copeland XWEB systems; investigators have not publicly confirmed the initial access vector.
- Many Danfoss controllers reportedly had internet-accessible web servers and used default credentials: “admin” and the current date as the password.
- CERT-FR recommended changing default passwords, factory-resetting compromised equipment and updating firmware; Danfoss said many affected products were legacy systems no longer receiving updates.
- Similar refrigeration attacks were reported in other European countries in November. A separate attack on three French blood banks was stopped before plasma was damaged.
- Experts cited shared remote-access configurations and internet exposure as risks, and recommended removing internet exposure where possible and securing access points.
Article Details
- Victim Organization
- French supermarkets (individual organizations not identified)
- Incident Type
- Reported compromise of refrigeration controls causing extended defrost cycles and physical disruption
- Operational Impact
- Approximately 700 stores in France were reportedly affected. Extended defrost cycles spoiled food and damaged refrigeration equipment, with some fires also reportedly occurring. The article reports millions of euros in damage. A similar attack on three French blood-bank refrigeration systems was stopped before blood plasma was damaged.
- Ransom Or Extortion
- Unknown
- Claim Status
- alleged
People
Chris St. MyersSentinelLABS director who discussed evidence of common exposure and the refrigeration systems involved.Piotr BulińskiQbee CTO who discussed the operational risks of unattended supermarket OT systems.Rafe PillingSophos senior director of threat research who discussed the security implications of the incident for retailers.Thomas PlankTributech CEO who discussed shared remote-access and firmware risks in the reported attacks.
Vendors
CopelandThe technology leveraged in these attacks included Danfoss refrigeration controllers, as well as Dixell and Copeland XWEB systems. It's unclear how the threat actor gained access to these systems.DanfossThe technology leveraged in these attacks included Danfoss refrigeration controllers, as well as Dixell and Copeland XWEB systems. It's unclear how the threat actor gained access to these systems.DixellThe technology leveraged in these attacks included Danfoss refrigeration controllers, as well as Dixell and Copeland XWEB systems. It's unclear how the threat actor gained access to these systems.
Products
Copeland XWEB systemsThe technology leveraged in these attacks included Danfoss refrigeration controllers, as well as Dixell and Copeland XWEB systems. It's unclear how the threat actor gained access to these systems.Dixell XWEBthat the French compromises involved Danfoss AK-SM and AK-SC controllers, along with Copeland and Dixell XWEB systems. These technologies are deployed across many retail environments, often with similar remote access
Countries
Belgiumand freezer systems in stores across other countries at the beginning of November, including Belgium, Estonia, Germany, Ireland, Luxembourg, Netherlands, Poland, Portugal, Spain, and Sweden. Around the sameEstoniaand freezer systems in stores across other countries at the beginning of November, including Belgium, Estonia, Germany, Ireland, Luxembourg, Netherlands, Poland, Portugal, Spain, and Sweden. Around the same time,Franceacross the country. The incident caused millions of euros in damage across roughly 700 impacted stores in France alone, spoiling food, damaging equipment, and even reportedly starting some fires in the process.Germanysystems in stores across other countries at the beginning of November, including Belgium, Estonia, Germany, Ireland, Luxembourg, Netherlands, Poland, Portugal, Spain, and Sweden. Around the same time, attackersIrelandin stores across other countries at the beginning of November, including Belgium, Estonia, Germany, Ireland, Luxembourg, Netherlands, Poland, Portugal, Spain, and Sweden. Around the same time, attackers targetedLuxembourgacross other countries at the beginning of November, including Belgium, Estonia, Germany, Ireland, Luxembourg, Netherlands, Poland, Portugal, Spain, and Sweden. Around the same time, attackers targeted theNetherlandscountries at the beginning of November, including Belgium, Estonia, Germany, Ireland, Luxembourg, Netherlands, Poland, Portugal, Spain, and Sweden. Around the same time, attackers targeted the refrigeration ofPolandat the beginning of November, including Belgium, Estonia, Germany, Ireland, Luxembourg, Netherlands, Poland, Portugal, Spain, and Sweden. Around the same time, attackers targeted the refrigeration of three bloodPortugalbeginning of November, including Belgium, Estonia, Germany, Ireland, Luxembourg, Netherlands, Poland, Portugal, Spain, and Sweden. Around the same time, attackers targeted the refrigeration of three blood banksSpainof November, including Belgium, Estonia, Germany, Ireland, Luxembourg, Netherlands, Poland, Portugal, Spain, and Sweden. Around the same time, attackers targeted the refrigeration of three blood banks operated bySwedenincluding Belgium, Estonia, Germany, Ireland, Luxembourg, Netherlands, Poland, Portugal, Spain, and Sweden. Around the same time, attackers targeted the refrigeration of three blood banks operated by the national
Industries
Food supply chainIt's highly unusual and hardly precedented for a cyberattack to have such a significant impact on the food supply chain, but it's not the only incident like it in recent memory.Retailcontrollers, along with Copeland and Dixell XWEB systems. These technologies are deployed across many retail environments, often with similar remote access requirements and configurations," St. Meyers says. "That