Overnight on October 11-12, supermarket freezers began heating up.
By early morning, hundreds of stores across France found their refrigerated display cases and cold rooms in forced-defrost mode, with temperature settings apparently adjusted to 50°C. Entire aisles of fresh and frozen goods had to be discarded. Two stores in Alsace alone reported losses totaling approximately €270,000. The Paris public prosecutor’s office has opened an investigation.
There was no data theft and no ransom demand. The attackers reportedly simply hijacked a standard controller function – defrosting – and forced it to run continuously.
What is striking is that none of this was truly unforeseeable. According to Danfoss, the affected controllers were either at the end of their service life or running outdated software. Vulnerabilities in this equipment had been publicly disclosed over the summer, and a patch was available. On the very day of the attack, a researcher identified nearly 1,600 such systems accessible via the Internet in France alone.
The scenario was well-documented; it just lacked someone to pay attention to it.
Implementation is often where things go wrong. Refrigeration systems, building management systems (BMS), access controls, and video surveillance are installed and maintained by third-party contractors, often with remote access enabled “for maintenance purposes.” The CISO doesn’t include them in the asset inventory, the refrigeration technician doesn’t consider cybersecurity, and each party assumes the other is handling it.
Here are a few questions to ask yourself this week – even if you don’t run a supermarket:
– Which technical systems at my sites are accessible via the Internet?
– Who connects to them remotely and with what credentials, and who terminates that access when a contract ends? – If one of them were to malfunction at 2 a.m. on a Sunday, how long would it take for someone to notice?
This last question carried significant weight here: the time the incident occurred – in the middle of the night – greatly exacerbated the losses.
So, does this equipment fall within the scope of the risk analysis, or does it remain the responsibility of the technical department?