Outdated Refrigeration Controllers Leave 700 European Supermarkets Vulnerable to Sabotage
Key takeaways
- 700+ supermarkets across six European nations hit by coordinated refrigeration system hack causing spoilage and fires.
- Attackers exploited known vulnerabilities in Danfoss, Dixell, and Copeland controllers that had been publicly documented for months.
- Basic security measures—VPNs, IP allowlists, firmware updates, credential changes—could have blocked the compromise entirely.
Attackers compromised refrigeration management systems at roughly 700 supermarkets across France, Spain, Portugal, Poland, Germany, and Belgium this week by exploiting critical vulnerabilities in controllers made by Danfoss, Dixell, and Copeland. The hackers remotely activated defrosters, pushing temperatures to 50°C (122°F), destroying perishables and triggering electrical fires in some locations. The damage likely runs into tens or hundreds of millions of euros.
The affected controllers contained well-documented flaws that researchers and government agencies had flagged months earlier. Danfoss devices used password schemes generated from publicly available firmware based on the date—identical across thousands of installations. Copeland and Dixell controllers had similar remote-access vulnerabilities patched only recently. Stores compounded the problem by leaving controllers directly exposed to the internet without VPNs, IP restrictions, or credential changes.
The bigger picture
This attack exposes a recurring failure in critical infrastructure: vendors ship devices with known weaknesses, operators ignore standard protections, and attackers exploit the gap at scale. Danfoss and Copeland's acknowledgment of discontinued models rings hollow—the threat research was public, the fixes were available, and the responsibility to patch ultimately rests with store operators and their IT teams. Expect regulators to push harder on critical-systems security audits.
We're covering this because it's a masterclass in how preventable catastrophe happens at scale. The attacker didn't need zero-days or genius; they needed stores to skip the basics. For anyone running connected infrastructure—retail, logistics, utilities—this is a reminder that security theater loses to discipline every time.
As an Amazon Associate, LagPing earns from qualifying purchases. Product links are affiliate links.
You might also like
Speedrunner JokerD Claims Level 60 Crown Again, Leaves WoW Forever Devs Scrambling
1d ago
Fort Stewart Battalion May Be Offering GTA 6 Leave as a Reenlistment Sweetener
Aug 18
Petlibro Server Outage Leaves Pets Hungry as Smart Feeders Stop Dispensing on Schedule
Aug 13
Critical BMC Flaws Leave 86,000+ Enterprise Servers Open to Silent Remote Takeover
Aug 6