Hijacked ICS Controllers Cook French Supermarket Fridges to 50°C
Attackers exploited internet-exposed Danfoss industrial controllers to remotely manipulate refrigeration systems across hundreds of French supermarkets, raising temperatures to 50°C and causing widespread food spoilage. The root cause lies in insufficiently secured remote access to operational technology (OT) systems — controllers were reachable from the internet without adequate authentication or network isolation. This incident demonstrates that OT/ICS devices are high-value targets with real-world physical and financial consequences when compromised. The lack of network segmentation between IT and OT environments allowed attackers to reach critical infrastructure systems that should never be directly internet-facing.
Tactical Insight
Immediate actions
- Audit and remove all direct internet exposure of ICS/SCADA controllers, placing them behind VPNs or jump hosts with strong MFA.
- Change all default credentials on Danfoss and similar OT controllers and enforce strong, unique passwords immediately.
- Apply all available vendor firmware and software patches to affected Danfoss controllers.
Long-term improvements
- Implement strict network segmentation (DMZ/air-gap where possible) between corporate IT networks and OT/ICS environments.
- Maintain a comprehensive, up-to-date inventory of all internet-facing industrial control assets and conduct regular vulnerability assessments.
- Work with vendors and supply chain partners to ensure remote management solutions meet minimum security baselines before deployment.
Detection measures
- Deploy OT-aware intrusion detection systems (e.g., Claroty, Dragos, Nozomi) to alert on anomalous commands or parameter changes in industrial controllers.
- Establish real-time alerting for out-of-range setpoint changes on critical systems such as refrigeration, HVAC, and power controls.
- Define and rehearse an incident response playbook specifically for OT/ICS compromise scenarios, including manual override procedures.