Researchers warned attackers could 'defrost the food' months before French supermarkets got hit

Security researchers had warned about exploitable vulnerabilities in refrigeration controllers months before cyberattacks disrupted hundreds of French supermarkets, according to a report. In one instance, the vulnerability was disclosed more than a year prior to the attacks. On Sunday night, unknown criminals hacked thousands of controllers, raising the temperature as high as 122°F (50°C), which led to spoiled food and fires in nearly 700 supermarkets across France.

France's national cybersecurity agency ANSSI issued an alert about widespread compromises involving Danfoss and Copeland refrigeration controllers. The compromised devices were accessible over the internet, with many not receiving software or security updates and running outdated firmware. While Danfoss and Copeland acknowledged the vulnerabilities, they stated they were working to mitigate the risk and strengthen cybersecurity through supported products and industry-recommended practices.

Cybersecurity firm Claroty's Team82 had raised concerns about the vulnerable devices in August, highlighting potential attacks that could "freeze the controller" and "defrost the food." The US Cybersecurity and Infrastructure Security Agency (CISA) had previously published advisories about security flaws in both brands' controllers, warning of potential exploitation to bypass authentication, cause denial-of-service conditions, and execute arbitrary code.

Despite the availability of patches, critical exposure to these threats continued, as 1,506 unique IP addresses were still publicly exposing Danfoss controllers as of October 6. Even after the cyberattacks, 618 Danfoss devices remained connected to the internet, with 206 still linked to French networks and 50 in the US.