Somebody Hacked the Fridges. Nobody Owned Them

Over the weekend, hundreds of supermarkets in France had to throw away their fresh food. No power cut, no broken compressor. Someone simply told the fridges to defrost, and kept telling them.

I have been thinking about that picture since yesterday, because I know that fridge. Not this exact one. But every company I have worked at had a version of it.

A very physical hack

Here is what is known so far. Overnight into Sunday, attackers reached the refrigeration controllers in around 400 French stores, according to BFMTV's reporting. About 300 were Intermarché and Netto shops, and nearly 100 were Coopérative U. The defrost function was triggered remotely, and products were pulled from the shelves. Two stores in Alsace alone reportedly lost around €270,000.

The affected systems reportedly run older versions of Danfoss refrigeration software. ANSSI, the French national cybersecurity agency, says it is handling the incident and coordinating with its European counterparts. The Paris prosecutor has opened an investigation. Dominique Schelcher, who leads Coopérative U, called the attack "unacceptable".

What nobody knows yet is how the attackers got in. Security researchers at Claroty had already published flaws in Danfoss refrigeration controllers, including a way around the login, and Danfoss released firmware fixes. They also counted more than 2,700 of these management interfaces reachable from the internet. Whether that was the door used this weekend is still an open question.

The box in the corner

It's the cron job on a VM nobody remembers creating. The admin panel that stayed on a public IP because the vendor needed access once. The build server that works perfectly, so nobody dares to upgrade it.

These systems have one thing in common: they are boring. They work. And because they work, they quietly fall off every list. They are not on the roadmap, nobody gets promoted for patching them, and when you ask who owns them, you mostly get a finger pointing somewhere else.

Look at the statement from Les Mousquetaires, the group behind Intermarché and Netto. The systems were managed by Danfoss, they said, so the supplier would need to file the criminal complaint. That may be completely correct on paper. But for the store manager standing next to a warm fridge full of yogurt, it doesn't matter whose name is on the contract.

A system nobody owns is not safe because it's quiet. It's quiet because nobody is looking.

This won't be the last one

Europe is full of these machines. Cooling, heating, door access, production lines. Many were installed years ago, connected to the network later because it was convenient, and then forgotten. I'd be surprised if Germany had fewer of them than France.

Rules for new connected products are getting stricter here, and that's good. But rules don't travel back in time to the controller that was installed years ago and still works fine.

And attackers have noticed something we keep forgetting. You don't need to steal a single byte of data to hurt a business. Turning up the temperature is enough.

What I would do this week

1. List the boring stuff. Every server, device, panel and integration that "just works". If it's not on a list, it's not being maintained. It's being ignored.
2. Put one name next to each item. A person, not a team and not a vendor. The vendor maintains the software. Someone inside your company still has to care about it.
3. Check what is reachable from the internet. Admin interfaces first. Most of them never needed to be public.
4. Managers, make maintenance visible. Thank the person who upgraded the forgotten service as loudly as the one who shipped the shiny feature. People repeat what gets noticed.
5. Plan for the quiet failure. Claroty showed that a compromised controller could switch off cooling while still reporting normal temperatures. So ask yourself: if this system lied to me, would anything else catch it?

Nobody in those stores did something dramatic and wrong on Sunday. If there was a mistake, it was made slowly, over years, by everyone assuming someone else was watching the fridge.

Sources: The Record: Cyberattack disrupts refrigeration at hundreds of French supermarkets, Cybernews: Refrigeration cyberattack hits French supermarkets, Claroty Team82: Freeze the Controller, Defrost the Food