Over a single night in mid-October, hundreds of supermarkets across France walked in to find their freezers warm, their fresh food ruined and, in some stores, fires that had broken out overnight. Hackers didn’t steal any data. They took over the refrigeration controllers and turned up the heat.
French officials and the chains themselves called the attack “unprecedented.” The lesson for everyone else is simple: the device most likely to hurt your business may be one nobody in your office thinks of as a computer.
What happened in France
Attackers reached the refrigeration management systems used by hundreds of grocery stores, including Intermarché, Netto, Carrefour, Coopérative U, Monoprix and several E.Leclerc locations. According to reporting from TIME, CBS News and Al Jazeera, they:
Forced coolers and freezers into continuous defrost cycles, pushing temperatures as high as 50°C (122°F). One store in Normandy reportedly hit 80°C (176°F).
Stretched defrost cycles from about one hour to eight, which Le Monde reported was done to delay the alarms.
Caused stores to throw out all of their fresh and frozen stock. Intermarché’s CEO put losses at “tens of millions of euros nationwide in a single day.”
Triggered fires at several stores, according to the Paris prosecutor’s office, which has opened a criminal investigation.
The affected systems were Danfoss AK-SM and AK-SC refrigeration controllers. Danfoss said most of the affected units were older “legacy” models running outdated firmware, and that it had already advised customers to update. Investigators have not said exactly how the attackers got in or who is behind it. France’s national cybersecurity agency, ANSSI, told companies using these models to disconnect them from the internet or restrict access immediately and to install updates.
How a refrigerator becomes a target
Modern equipment is managed remotely. Grocery coolers, rooftop HVAC units, security cameras, door access systems and even building lighting often come with a small web-based control panel. To make service easier, the installer or maintenance company puts that panel on the internet so they can log in from anywhere.
That convenience is the problem. Security researchers found that France had nearly 60% of the exposed Danfoss controllers they could see online worldwide, with more in the U.S., the U.K. and elsewhere. Earlier this year, researchers also published a login-bypass flaw in one of the affected controller models. Danfoss released firmware fixes, but devices that never get updated stay vulnerable.
The French government called putting these control panels directly on the internet “contrary to best practices.” Yet it is common, because the device was installed by a vendor, works fine, and no one on staff knows it is there.
This isn’t just a grocery store problem
Every business has “forgotten” devices. Ask yourself whether any of these are reachable from the internet, and who last updated them:
Heating and cooling controls and smart thermostats
Security cameras and DVRs
Door access and alarm panels
Walk-in coolers and freezers in restaurants, convenience stores and medical offices
Printers, copiers and network storage drives
Water, wastewater and utility controls in towns and rural districts
Farm and plant equipment like grain bin monitors and production line controllers
At home, the same risk lives in old Wi-Fi routers, cheap cameras, baby monitors and smart plugs that haven’t had an update in years.
The attack in France didn’t need anyone to click a phishing email. It went straight for equipment that was exposed, outdated and unwatched. In this case the damage was spoiled food, fires and millions in losses. In your building, it could be a frozen production line, a disabled alarm, a camera feed watched by strangers or a doorway into the rest of your network.
6 steps to take this week
Make a list of every connected device. Walk the building. If it plugs into the network or has an app, it goes on the list.
Get control panels off the open internet. Remote access should go through a VPN or be limited to specific, trusted IP addresses. Nothing should have a login page open to the whole world.
Ask every vendor how they connect. Your HVAC, refrigeration, camera and alarm companies should be able to tell you exactly how they reach your equipment and who has the password.
Change default passwords and turn on multi-factor authentication wherever it is available.
Update firmware, and plan to replace gear that no longer gets updates. “It still works” is not the same as “it’s still safe.”
Monitor the alarms, not just the equipment. In France, attackers delayed alarms on purpose. Make sure someone finds out fast when a system or an alert goes quiet.
At home: update or replace any router more than five years old, change default passwords on cameras and smart devices, and turn on automatic updates.
The bottom line
Attackers no longer need to break into your computers to shut you down. A single forgotten device with a login page on the internet can do it. The good news is that this is one of the easiest risks to find and fix, as long as someone actually looks.
Get a free exposure check from MSP Today’s Trusted Tech Partner
JK Computer Solutions, MSP Today’s Trusted Tech Partner, will scan your business from the outside the way an attacker would and show you exactly what is exposed: forgotten control panels, cameras, remote access tools and outdated equipment. You’ll get a plain-English written report with what to fix first. It’s free, with no obligation, through December 31.
Have questions about your home network? JK can help with that too.
Request your free exposure check from JK Computer Solutions or call (618) 242-1870.
Sources: TIME, CBS News, Al Jazeera.