European Supermarket Refrigeration Controllers Hacked via Exposed Interfaces and Legacy Flaws
MEP · Smart operations
Supermarkets across several European nations experienced unauthorized disruptions to their refrigeration controls, switching units to defrost mode. Investigations and security analyses indicate the incidents stemmed from management interfaces exposed to the public internet, weak passwords, and legacy controller vulnerabilities.
Following incidents across hundreds of supermarkets in France, commercial refrigeration units in Belgium, Sweden, and other European countries were remotely compromised, with temperatures altered to 50°C. Retailers and media reports indicated that attackers gained unauthorized access to control systems, forcing them into defrost mode and halting evaporator cooling. Findings show the breaches were facilitated by remote management systems exposed directly to the public internet without proper network defenses and secured by weak credentials. Additionally, older Danfoss controllers involved in the attacks had previously reached end-of-support and harbored known authentication weaknesses, while challenges in taking systems offline for updates and reliance on third-party contractors left thousands of units vulnerable.
Key takeaways
- Refrigeration systems across multiple European supermarkets were compromised and shifted to defrost mode, halting cooling operations.
- Inquiries show primary vulnerabilities stemmed from management portals directly exposed to the internet, insufficient network defenses, and weak passwords.
- Targeted units included legacy Danfoss controllers that had reached end-of-support and contained documented authentication bypass flaws.
- Security analysts noted that reliance on outsourced maintenance and the operational hurdles of offline updates delayed essential patching.
Source：公視｜新聞 Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.