700 Supermarkets Hacked Through Their Fridges

Earlier this week, a mass hack of refrigeration systems hit an estimated 700 supermarkets throughout France. The attackers remotely cranked defrosters until fridges reached 50 degrees Celsius (122 degrees Fahrenheit). Food spoiled by the ton. In some cases, electrical systems caught fire.

The attack targeted Internet-connected controllers that allow technicians to remotely administer store-wide refrigeration fleets. Three controller models were reportedly compromised, sold by Danfoss of Denmark and Dixell and its parent company Copeland in the US. All three had known vulnerabilities.

Date-Based Passwords

The most striking detail: Danfoss controllers used a credential that changes each day, generated by publicly available firmware based on the date. Anyone who analyzes the firmware code can reproduce the password for any device running unpatched firmware. The daily password is identical across all models in hundreds or thousands of stores.

This is not a zero-day. This is not a sophisticated supply chain attack. This is the IoT equivalent of leaving the door open with a sign that says "free food."

Known Vulnerabilities, Ignored Warnings

Multiple security advisories from CISA documented the vulnerabilities in these controllers [1][2]. The flaws allow remote login with administrator privileges. No authentication bypass needed, no exploit chain, just default credentials and exposed management interfaces.

The supermarkets were not the first victims of these vulnerabilities. Researchers had documented them. CISA had published advisories. The patches existed. Nobody applied them.

The Cost Of IoT Neglect

The financial damage runs into millions of euros. Perishable goods across 700 stores, spoiled. Electrical systems damaged by overheating. Fire damage in multiple locations. Operational downtime during restocking and repair.

This is the pattern of IoT security failures: devices are deployed, connected to the Internet, and then forgotten. Firmware updates are never applied. Default credentials are never changed. Management interfaces are exposed to the public web. The devices keep running for years, silently vulnerable, until someone decides to exploit them.

The same negligence that left these refrigeration controllers exposed is what left thousands of IP cameras, routers, and DVRs available for Mirai botnet conscription in 2016. The difference is that Mirai launched DDoS attacks. These fridge hacks caused physical fires.

Lessons That Will Be Ignored Again

The fix is simple and well understood. Segment IoT devices on separate networks. Change default credentials. Apply firmware updates. Close management interfaces to the public Internet. Use VPN or zero-trust access for remote administration.

Every one of those recommendations has been in every IoT security guide for the past decade. Every incident report says the same thing. The advice is free, the patches are free, and the consequences are measured in millions of euros and physical fires.

The problem is not technical. It is operational. Nobody owns the lifecycle. The installer leaves, the technician moves on, and the device runs until it breaks or gets hacked. In this case, it got hacked.

700 supermarkets learned this the hard way. The next 700 will learn it the same way.