Around 700 supermarkets in France were hit by an attack on their refrigeration systems. Hundreds of deep freezers thawed, flooding shop floors and spoiling large quantities of food. In some locations temperatures rose far enough to start fires. Estimated losses are about €10m.
How it was done
Supermarket refrigeration runs on central online controllers, so technicians can monitor and adjust temperatures remotely over the internet. According to ANSSI, the French cyber security agency, the attackers targeted older controllers running outdated or end-of-life software, made by the multinational firms Danfoss and Copeland.
Security updates were missing, and the systems were sitting exposed on the internet. The attackers took remote control, got past password verification, switched on the automatic defrost function and removed the upper temperature limit. Freezer temperatures climbed to around 50°C overnight.
Experts quoted in the reporting made the point that matters most: the attack did not need complex code. Nothing here was a feat of exploitation. It was equipment that should not have been reachable, running software that should have been replaced.
Why removing the limit is the clever part
Turning on defrost alone would be noticed and reversed. Removing the upper temperature limit is what turned a nuisance into a loss, because the safety ceiling that would normally stop a freezer heating past a set point was simply deleted. The controller then did what it was told, all night, without complaint.
That is the recurring shape of attacks on industrial equipment. The damage rarely comes from breaking the machine. It comes from operating the machine correctly, with the limits taken off.
Read this from Bangladesh
The country’s cold chain is not a supermarket problem; it is a pharmaceutical, poultry, dairy and frozen-fish export problem. Vaccine and insulin storage, hatchery incubators, ice plants and the cold stores that hold shrimp for export all run on controllers of exactly this kind, many of them imported years ago and never updated — because updating an industrial controller means downtime, and downtime means spoiled stock.
Three questions are worth putting to whoever maintains that equipment. Is any of it reachable from the internet, directly or through a remote-support tool left switched on? Is the software still supported by the manufacturer, or past end of life? And does the controller enforce a hard temperature ceiling that cannot be changed remotely?
If the honest answer to the first is “probably” and to the second is “nobody has checked”, that is the same position 700 French supermarkets were in last week. The difference is that a thawed freezer in Dhaka may hold vaccines rather than ice cream.
The pattern this belongs to
Operational technology — the controllers running pumps, chillers, lifts, generators and production lines — was designed in an era when nothing was networked. Security was physical: if you could not reach the panel, you could not change the setting. Then remote monitoring arrived, the panel acquired an internet connection, and the assumption underneath the design quietly stopped being true.
What makes this class of equipment awkward is the replacement cycle. A web server is replaced every few years; a refrigeration controller is expected to last fifteen, and the manufacturer may stop issuing updates long before the hardware fails. End of life for the software does not mean end of life for the machine, so the two timelines drift apart and the gap is where attacks like this one live.
