Attackers compromised internet-connected controllers for refrigeration systems across multiple European countries, including France, Spain, Portugal, Poland, Germany, and Belgium. By remotely activating defrosters, they raised temperatures to 50 degrees Celsius, resulting in spoiled food and electrical fires.
The breach involved three controller models from Danfoss, Dixell, and Copeland. These devices contained critical vulnerabilities allowing unauthorized remote administrative access. In some cases, passwords were generated daily based on public firmware code, making them predictable for attackers who analyzed the software.
Security experts from Pen Test Partners noted that the incident could have been prevented by basic cyber hygiene. Recommended measures included isolating controllers from the public internet, using VPNs, restricting IP access, and applying firmware updates. Many affected stores failed to implement these standard protections.
Copeland stated that the vulnerabilities were identified in discontinued, end-of-life controller generations and that they are assisting customers. Danfoss also referenced discontinued models in response to the situation. The financial impact of the mass hack is estimated to reach tens or hundreds of millions of euros.
While the perpetrators remain unidentified, researchers suggest the motive could range from mass vandalism to state-sponsored disruption. The event highlights the ongoing conflict between business cost-cutting and the necessity of investing in secure infrastructure to prevent large-scale operational failures.
