A hack of Internet-connected fridge controllers across ~700 European supermarkets exploited critical vulnerabilities in three models flagged by Claroty and CISA

Your grocery bill will likely increase due to spoiled inventory and the cost of system repairs across affected chains.

Approximately 700 supermarkets across Europe, including in France, Spain, Portugal, Poland, Germany, and Belgium, experienced a widespread hack of their refrigeration systems. The attackers exploited critical vulnerabilities in Internet-connected controllers from manufacturers Danfoss, Dixell, and Copeland, which allowed for remote administrative access. By activating defrosters, the attackers caused food spoilage across potentially millions of euros worth of perishables and, in some instances, triggered fires due to overheating. The vulnerabilities exploited were present in outdated devices, some of which were end-of-life models, and were previously flagged by security firms Claroty and CISA. This incident highlights a failure to implement basic cybersecurity measures such as placing devices behind a VPN, using IP allowlists, and updating firmware, leading to a mass disruption.

This incident reveals a significant gap in operational technology (OT) security within the retail sector, where critical infrastructure like refrigeration is exposed to the internet without adequate protection. The reliance on outdated or end-of-life hardware, combined with lax network security practices, creates a large attack surface that sophisticated actors can exploit for widespread disruption. The scale of this attack, affecting hundreds of stores, suggests a potential for coordinated, financially motivated or even state-sponsored cyber campaigns targeting essential services.

The exploitation of simple, well-documented vulnerabilities in commonly used industrial control systems underscores the urgent need for better visibility and management of OT assets. Retailers and other organizations must prioritize patching, network segmentation, and robust access controls for all connected devices, not just IT systems. This event will likely prompt greater scrutiny from regulators and insurers on OT security, potentially leading to new compliance requirements and increased investment in specialized security solutions for critical infrastructure.