Key Takeaways
- Hackers targeted 700 supermarkets in France, causing food spoilage and fires.
- Internet-connected controllers were compromised, allowing attackers to raise temperatures.
- Vulnerabilities in Danfoss and Dixell controllers enabled the hack.
French authorities have reported a significant cyber-attack on supermarket refrigeration systems, affecting an estimated 700 stores across the country. The incident, which has caused millions of dollars in losses, saw hackers remotely control the temperature settings of the refrigerators and freezers, leading to food spoilage and, in some cases, fires.
The compromised systems, which include Internet-connected controllers used to remotely administer the store-wide refrigeration systems, were reportedly made by Danfoss of Denmark and Dixell and its parent company Copeland in the US. These controllers were found to contain critical vulnerabilities that allowed attackers to gain full administrative access.
According to security advisories and public research reports, the Danfoss controllers, in particular, used a daily-changing password generated by the firmware based on the date. Hackers could easily replicate this password if they analyzed the code, making it possible to gain access to multiple devices without needing to update them regularly.
The attackers activated defrosters, causing the refrigerators to reach temperatures as high as 50°C (122°F), leading to the spoilage of untold tons of perishable goods. By the time the mass compromise was discovered, the damage was already extensive, with some stores experiencing electrical system fires.
French authorities have stated that basic cybersecurity measures could have prevented this incident. The hack highlights the critical need for improved security practices in the Internet of Things (IoT) sector, particularly in critical infrastructure such as food storage systems.
Danfoss and Dixell have been criticized for the vulnerabilities in their controllers, which were known but not adequately addressed. The company responsible for the hack has not been identified, and the extent of the damage remains unclear.
Experts warn that similar incidents could occur if companies do not take immediate action to secure their IoT devices. The incident serves as a stark reminder of the potential risks associated with poorly secured Internet-connected devices in critical sectors.
The French government is currently investigating the incident and has called for stricter cybersecurity regulations to prevent such attacks in the future. The incident has sparked a broader debate on the need for enhanced cybersecurity measures in the retail and food industries.
