Attackers raise EU supermarket fridge temps to 50°C via weak controller access, causing fires and spoilage

French authorities reported that internet-connected refrigeration controllers were compromised at an estimated 700 supermarkets throughout Europe earlier this week. These devices, which allow technicians to administer store-wide cooling systems remotely, were manipulated by unknown attackers. The breach caused sudden malfunctions, leading to the spoilage of perishable goods and, in some instances, electrical fires within the facilities.

Root cause

According to Ars Technica, the incident stemmed from critical vulnerabilities in controller models sold by Danfoss and Dixell, a subsidiary of Copeland. These flaws permitted attackers to log in with full administrative rights. Danfoss controllers previously used daily passwords generated from publicly available firmware based on the date. Because these credentials were identical across thousands of devices, attackers could replicate the login process on any unupdated unit.

Attack path

Attackers exploited the fact that the controllers were exposed directly to the internet. They bypassed standard security measures by leveraging outdated firmware and predictable authentication mechanisms. Once inside, they activated defrosters for extended periods, causing internal temperatures to reach 50° Celsius. This deliberate manipulation led to rapid food spoilage and overheating of electrical components, which sparked fires in some locations.

Affected versions

• Danfoss controllers using date-based daily password generation from public firmware.
• Dixell and Copeland controllers with critical vulnerabilities fixed in recent months.
• Devices running outdated firmware that had not received recent security updates.

Mitigation

• Ensure all refrigeration controllers are updated to the latest firmware versions provided by vendors.
• Place internet-connected industrial devices behind a virtual private network (VPN) to restrict external access.
• Implement strict IP address whitelisting to limit login attempts to authorised technician ranges only.

What it means for organisations

Operations teams must verify whether critical infrastructure devices are exposed to public networks. Security leaders should assess if vendor-supplied credentials are predictable or shared across multiple sites. Procurement departments need to review supplier security practices regarding firmware updates and access controls. Incident response plans should include procedures for physical systems that can cause safety hazards when compromised, ensuring rapid isolation capabilities are in place.

What to do and how to stay safe: Danfoss

• Audit all internet-facing industrial control systems for default or predictable credentials.
• Verify that remote management tools are accessed only through secure, authenticated channels.
• Monitor device logs for unusual configuration changes, such as unexpected defrost cycles.
• Confirm that firmware update policies are enforced regularly across all operational hardware.

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which companies' devices were affected by this attack?

Controllers manufactured by Danfoss and Dixell, which is owned by Copeland, were reportedly compromised in the incident.

How did the attackers gain access to the systems?

They exploited critical vulnerabilities that allowed remote login with administrative rights, often using predictable daily passwords.

What was the financial impact of the breach?

The mass hack likely cost tens or hundreds of millions of euros across several European countries, according to Ars Technica.