Outdated Refrigeration Controllers Enable Remote Sabotage of French Supermarkets
Attackers exploited known vulnerabilities in aging Danfoss refrigeration controllers to remotely disable refrigeration systems across hundreds of French supermarkets overnight, causing widespread food spoilage and significant financial damage. The root cause lies in unpatched, internet-exposed operational technology (OT) devices that lacked adequate network isolation from external threats. This incident highlights the growing danger of neglecting legacy industrial control systems (ICS) in retail and food supply environments, where cyber-physical attacks have direct, real-world consequences. The attack is a stark reminder that OT and IoT devices are increasingly targeted and must receive the same security rigor as traditional IT infrastructure.
Tactical Insight
Immediate actions
- Audit and immediately patch or replace all legacy Danfoss refrigeration controllers and similar OT/ICS devices running outdated firmware.
- Isolate refrigeration control systems from the public internet by placing them behind firewalls or removing direct external access entirely.
- Change all default credentials on refrigeration and building management system controllers.
Long-term improvements
- Implement strict network segmentation between corporate IT networks and operational technology (OT) environments using dedicated VLANs or air gaps.
- Maintain a comprehensive, up-to-date asset inventory of all OT/ICS and IoT devices, including firmware versions and patch status.
- Establish a formal OT vulnerability management program with regular scanning and a defined patching cadence for industrial control systems.
Detection measures
- Deploy anomaly-based monitoring on OT networks to detect unauthorized commands or unusual parameter changes to refrigeration controllers.
- Set up real-time alerting for out-of-range temperature readings or unexpected device configuration changes across all refrigeration units.
- Conduct periodic penetration testing specifically targeting OT and ICS environments to identify exploitable entry points before attackers do.