Fridge hack costing millions and sparking fires stemmed from poor security

A mass hack of refrigeration systems at around 700 supermarkets across France has resulted in system malfunctions, spoiled perishable goods, and even fires. French authorities report that the issue stemmed from a lack of proper cybersecurity measures. The affected systems comprised numerous refrigerators and freezers throughout each store, all controlled by interconnected devices.

Hackers exploited vulnerabilities in these Internet-connected controllers, allowing them to take remote control of the store-wide system. Once in control, the cybercriminals activated the defrosters, causing the refrigerators to rise to temperatures up to 50°C (122°F). By the time the breach was detected, the compromised food was spoiled and, in some instances, the electrical systems caught fire.

Multiple security advisories and research reports reveal that the three models of controllers reportedly exploited in the incident—manufactured by Danish company Danfoss, US-based Dixell, and its parent company Copeland—contained critical flaws that permitted unauthorized remote login with administrator privileges. In some cases, such as Danfoss controllers, the password was a daily one generated by the public firmware based on the date.

This meant that a hacker, after analyzing the code, could replicate the same credential for any device that hadn't received an update. The daily password remained consistent across numerous models in hundreds or thousands of stores.