I'm late writing this up, and I owe it a post, because it's the most absurd and the most instructive security story of the fall. Attackers have been logging into supermarket refrigeration controllers across Europe and turning the fridges into ovens. This week it hit a blood bank, and US agencies put out a joint warning.
What Happened
Wave one, October 11 to 12. Per SecurityWeek's reporting, attackers set refrigerators and freezers to defrost overnight, with target temperatures as high as 50°C (122°F). Most of the damage was in France, roughly 700 supermarkets, with chains including Auchan, Carrefour, E.Leclerc, Intermarché, Monoprix and Coopérative U reported affected. CERT-FR first tied it to Danfoss controllers, then widened the alert to Copeland and Dixell XWEB systems.
Wave two, November 1 to 2. More than 100 stores across Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden, with problems also reported in Finland, Italy and Portugal. Belgium was hit hardest. The same night, France's blood service (EFS) said temperature and defrost thresholds were raised "to extremely high levels" at three plasma cold-storage sites. Monitoring caught it and staff moved fast: "no blood products or samples were compromised."
The US response, November 5 to 6. CISA, the FBI, HHS, USDA and DoT issued a joint notice warning healthcare, chemical, food and transportation organizations about actors targeting electronic temperature and commercial refrigeration controllers.
Nobody has confirmed who's behind it. Pro-Russian hacktivist groups have claimed things, and the BBC has reported other possibilities. I'm not going to pick one.
How They Got In (What We Know)
Officials haven't published the exact method. But the pattern is pretty clear from what's public:
- Kevin Beaumont said every freezer hit in wave two had a management interface reachable from the internet, and that many of the devices are end-of-life with no patch.
- Lupovis saw login attempts against Danfoss AK-SM sensors in late October, mostly using factory-default credentials that are publicly documented.
- Danfoss said most hacked units were legacy products it no longer updates, and told customers on October 13 to cut internet connections. "Most stores took action at that time, but a small number did not."
- The US notice says actors "may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers."
So: old devices, default passwords, admin pages on the open internet. Not a zero-day story. An exposure story.
The Good News Is Measurable
Exposure is actually dropping. Censys, per SecurityWeek, counted 6,695 internet-exposed refrigeration controllers on October 9 and 3,124 still reachable on November 5. Danfoss StoreView in France went from 1,825 to 220. That's real progress, and it happened because people unplugged things.
Which is the whole point. The fix that worked here wasn't a patch. It was removing internet access.
My Take
(Disclosure: I work at Zscaler, and connecting people to systems without exposing those systems to the internet is literally the product. Weigh accordingly. But CISA said it too.)
Every OT conversation I have eventually gets to "but the vendor needs remote access" or "the facilities team needs to check temps from their phone." Fair. That's a real requirement. The answer to it is never "put the controller's login page on the internet with the default password." It's brokered, authenticated, logged access to that one device, for the people who need it, and nothing else.
The US agencies said it plainly: "taking the control systems off the internet is the best action." A freezer doesn't need to be findable on Shodan to keep ice cream cold.
What To Do
- Find your controllers. Search your own external IP space (or Censys/Shodan) for refrigeration, HVAC, building management and any other OT web interface. If you find one, that's today's project.
- Take them off the internet. If remote access is needed, put it behind a VPN or zero trust access with MFA, not a port forward.
- Change default credentials. Every one. Today.
- Plan for end-of-life gear. If the vendor no longer patches it, it can't be exposed, period. Budget to replace it.
- Monitor setpoints, not just alarms. The EFS caught this because its monitoring flagged the change. Alert on any setpoint change outside a maintenance window.
- Have a manual fallback. Know how staff can override and verify temperatures locally when the controller can't be trusted.
Bottom Line
The most damaging OT attack of the season was mostly people logging into fridges that should never have been reachable. That's bad news, because it's easy. It's also good news, because so is the fix: get it off the internet.
Sources: SecurityWeek on the US joint notice, SecurityWeek on wave one, SecurityWeek on wave two, and SecurityWeek/AP on the French blood bank