Cyberattack on French Supermarket Refrigeration Systems Highlights OT Vulnerabilities
Hackers exploited known vulnerabilities in internet-connected refrigeration controllers to spoil food and cause fires.
1Widespread Refrigeration Sabotage
Unknown criminals recently hacked thousands of refrigeration controllers across nearly 700 French supermarkets. By remotely increasing temperatures to 122°F (50°C), the attackers successfully spoiled food supplies and triggered localized fires. This incident highlights the severe physical consequences of compromising operational technology systems that remain connected to the public internet without adequate security.
2Known Vulnerabilities Ignored
Security researchers at Claroty’s Team82 identified these critical flaws back in August, warning that attackers could easily defrost food. Despite these public disclosures and earlier advisories from CISA regarding authentication bypass and arbitrary code execution, many systems remained unpatched. The attack occurred months after these specific security risks were documented and widely reported.
3Manufacturer and Agency Responses
France’s national cybersecurity agency, ANSSI, confirmed widespread compromises involving Danfoss and Copeland controllers. While Danfoss released firmware update R4.3.1 to mitigate these risks, Copeland noted that the affected devices were discontinued, end-of-life models. Both companies are currently working with impacted customers to address the ongoing risks associated with these legacy hardware units.
4Persistent Internet Exposure
Data from Coalition reveals that over 2,600 refrigeration controllers from these brands remained accessible via the open internet as of October. Even after the French attacks, hundreds of Danfoss devices continue to expose admin panels to public networks. This persistent exposure demonstrates a failure to isolate critical industrial infrastructure from the broader internet.
5Quantifying the Digital Risk
Coalition’s sensors identified 1,506 unique IP addresses exposing Danfoss StoreView panels between September and October. Approximately 54 percent of these exposed systems were located within French networks. Although not every exposed device is inherently vulnerable, the open accessibility provides a primary entry point for malicious actors targeting industrial and operational technology environments.
6OT Security Coalition Demands
The Operational Technology Cybersecurity Coalition, including members like Honeywell and Schneider Electric, is calling for stronger protections. They have urged CISA to issue a Binding Operational Directive to improve security standards. The group argues that the French incident serves as a clear warning for the US food and agriculture sector to act.
7Expanding Threat Landscape
Tiago Henriques of Coalition emphasized that digital risk extends far beyond traditional workstations and email servers. Industrial devices, often overlooked in standard security audits, are increasingly becoming targets for sophisticated criminals. Organizations must prioritize identifying these exposed access points to preserve business continuity and prevent physical damage to their critical operational infrastructure.
8Urgency for Proactive Defense
The French supermarket incident underscores the necessity of implementing baseline cybersecurity measures for all operational technology. With malicious actors likely viewing this attack as a blueprint for future operations, proactive patching and network isolation are essential. Stakeholders cannot afford to wait for domestic incidents before adopting industry-recommended practices for securing industrial controllers.