The French Fridge Failure: A Lesson in Internet Exposure
Hundreds of supermarkets across France recently learned an expensive lesson about cybersecurity: a machine does not have to look like a computer to be hacked like one.
Attackers remotely manipulated the controllers used to manage commercial refrigeration systems. They forced equipment into extended defrost cycles and reportedly raised temperature settings as high as 50°C (122°F). At that point, the equipment was doing a fairly convincing impression of an oven, only one stocked with frozen food. Stores lost refrigerated and frozen products, some temporarily closed, and authorities investigated reports of fires and flooding.
By October 14, the French government estimated that approximately 700 of the country’s 10,000 supermarkets had been affected. Intermarché said its losses reached tens of millions of euros in a single day. French cybersecurity authorities also warned that attacks were likely still underway. Associated Press
The incident sounds dramatic, but its central lesson is remarkably ordinary:
Do not expose critical management systems directly to the public Internet. I have a simple rule: if a system was not designed and hardened to live on the public Internet, it has no business being there. The Internet is exceptionally good at finding the things administrators hoped nobody would notice.
Convenience Became an Attack Surface
Commercial refrigeration systems need remote management for legitimate reasons. Technicians monitor temperatures, review alarms, adjust schedules, and troubleshoot equipment across many locations. Remote access saves time, reduces travel, and can help technicians respond before a mechanical problem ruins thousands of dollars’ worth of food.
But remote access and direct Internet exposure are not the same thing.
Security researchers examining Danfoss refrigeration controllers found thousands of management interfaces accessible from the public Internet. An attacker would not necessarily need to breach a supermarket’s corporate network or gain physical access to a store. Vulnerable controllers could be discovered using the same Internet-scanning services routinely used by researchers, administrators, and attackers.
Once a management interface is publicly reachable, every weakness behind it becomes much more dangerous.
Reuters found at least 4,500 Danfoss management interfaces still visible through Shodan after the attacks. That does not mean every device was vulnerable or compromised, but it illustrates the scale of the unnecessary exposure. Reuters
The Code of the Day
One vulnerability makes the case especially memorable.
Researchers at Claroty discovered a hidden “code-of-the-day” authentication mechanism in the Danfoss AK-SM 800A platform. A separate administrative code could be calculated from the device’s current date using a reproducible algorithm, allowing someone who knew the method to obtain an administrative session without the customer’s actual password. Claroty also identified a separate command-injection vulnerability that could give an authenticated attacker remote code execution on the controller. Claroty
That weakness is often summarized as “the password was today’s date,” but that is convenient shorthand, not the literal design. More accurately, it was a hidden, date-derived authentication bypass. Investigators have not publicly confirmed that attackers used this particular flaw in France. Even so, changing the normal administrator password could not remove a second, undocumented route into the system. Updated firmware, replacement of unsupported equipment, and proper network controls were still required.
The Attack Expanded
The first reports focused largely on Danfoss equipment. Subsequent attacks involved refrigeration controllers from other manufacturers, including Dixell and Copeland.
At one supermarket using Dixell equipment, attackers reportedly changed a frozen-goods setting from –22°C (–8°F) to 150°C (302°F). A refrigeration specialist said settings were being altered two or three times per second, far faster than a person would normally operate the interface, suggesting that at least part of the attack may have been automated. Technicians intervened before products had to be discarded at that location. Other stores were not as fortunate. Le Monde
That expansion is significant. This was not simply one defective product or one unfortunate password. Multiple families of remotely managed refrigeration controllers were compromised.
Europol is now in contact with national authorities, but no perpetrator has been publicly identified and no claim of responsibility has emerged. A separate cybersecurity incident affected supermarket operations in the Netherlands, but Dutch authorities said they had no reason at that point to conclude that the incidents were connected.
Cybersecurity Became Food Safety
This was not merely a website outage or another stolen-password notification.
Refrigeration controllers operate physical equipment. Changing their settings can spoil food, damage machinery, interrupt store operations, activate sprinkler systems, and potentially create safety hazards. A weakly protected management page is therefore more than an information-security problem. It is an operational, financial, and food-safety problem.
That is one of the most important lessons from the incident.
Organizations often give servers, laptops, and payment systems the most security attention. Building controls, refrigeration systems, cameras, access-control panels, and other operational technology may instead be managed by facilities teams, franchise operators, specialized vendors, or outside contractors.
Yet those overlooked systems can have the most immediate physical consequences when compromised.
The fragmented responsibility also makes remediation harder. A supermarket may own the food and the building while relying on another company to install and remotely maintain its refrigeration controls. When nobody clearly owns the cybersecurity risk, insecure configurations and obsolete devices can survive for years.
The Basics Still Matter
France’s national cybersecurity incident-response organization, CERT-FR, offered straightforward advice: remove affected controllers from direct Internet exposure, verify their configurations, restore compromised devices, update their firmware, and permit remote access only through a protected network or secure VPN.
It also warned that simply factory-resetting an unsupported, Internet-exposed device would not solve the problem. The controller could quickly be compromised again. CERT-FR
Those recommendations are not revolutionary. That is precisely the point.
The attack reinforces several basic principles:
Administrative interfaces should not be directly reachable from the public Internet.
Remote maintenance should pass through controlled and strongly authenticated access.
Operational systems should be inventoried, segmented, monitored, and patched.
End-of-life equipment should be replaced rather than left online indefinitely.
Organizations must understand which contractors can remotely access physical systems.
Unusual configuration changes should trigger immediate alerts.
Safety controls should not depend entirely on the same controller an attacker can manipulate.
Modern security discussions often focus on artificial intelligence, nation-state capabilities, and previously unknown vulnerabilities. Those threats are real. But many damaging incidents still begin with simpler conditions: an exposed interface, unsupported software, a known flaw, or a maintenance shortcut nobody revisited.
The lesson from France is not that refrigeration systems should never be connected to a network. Connected monitoring and carefully controlled remote maintenance provide real benefits.
The lesson is that connected does not have to mean publicly exposed.
If a system can spoil food, stop production, unlock a door, or change the physical environment, its management interface should not be one Internet scan away.
────────────────────────
Enjoyed this article?
Subscribe to Between The Hacks for practical cybersecurity, real-world stories, and fresh perspectives on the technologies shaping our digital future.
