700 Stores, One Attack, Predictable Consequences
Across France this week, refrigeration systems in roughly 700 supermarkets failed simultaneously – not because of a grid failure or equipment fault, but because someone got in remotely and turned the defrosters on. Temperatures inside compromised units climbed to 50° Celsius (122° Fahrenheit). Food spoiled by the ton. In several locations, the electrical systems caught fire.
The attack targeted Internet-connected controllers – the kind that let technicians manage entire store-wide fleets of refrigerators and freezers from off-site. Once attackers reached those controllers, they had the same system access as authorized administrators.
French authorities are investigating, and the identity of the attackers remains unknown. What is not unknown, and has not been unknown for some time, is that the specific hardware involved carried documented security vulnerabilities that were publicly flagged before any of this happened.
Three Controller Models, Years of Known Weaknesses
The controllers involved were manufactured by three companies: Danfoss, a Danish firm, and Dixell along with its US-based parent company Copeland. Security advisories and published research reports had already identified critical flaws in all three product lines before this incident. Those flaws share a common characteristic – they allow an outside attacker to log into the devices remotely with full administrator-level rights. No physical access required. No inside knowledge of a specific store’s network. Just a working exploit and an unpatched device.
The Danfoss situation is particularly stark. Until recently, these controllers used daily-rotating passwords – a design that sounds more secure than a static credential but falls apart under scrutiny. The password for any given day is generated by the device’s own firmware, and that firmware is publicly available. Any attacker willing to study the code can reverse-engineer the generation logic and produce the correct password for any date, on any device running an outdated software version. The daily password is not unique to a store or a device. It is identical across every unit of the same model that has not been updated – meaning one cracked password is effectively a skeleton key across hundreds or thousands of installations.
That is the architecture that was sitting inside French grocery stores when this attack happened.
The Gap Between Connected Hardware and Secured Hardware
Refrigeration controllers with remote access capabilities are not a new product category. The convenience argument is legitimate: technicians can monitor compressor performance, respond to temperature anomalies, and run diagnostics without dispatching someone to the store. For a retail chain managing dozens or hundreds of locations, that operational efficiency has real value. The problem is that Internet connectivity in industrial and commercial hardware has historically arrived without the security infrastructure that the connection demands. A device that can be reached remotely by a technician can, under the right conditions, be reached remotely by anyone.
The vulnerabilities in the Danfoss, Dixell, and Copeland controllers are not obscure zero-days discovered only after the attack. They appear in multiple public security advisories – the kind of disclosures that responsible vendors and operators are expected to act on. Patching and updating this class of hardware is not always straightforward; field devices in commercial refrigeration systems are often installed and left running for years without firmware updates, partly because updating requires coordination between store operators, refrigeration contractors, and equipment vendors. That friction does not make the unpatched state acceptable, but it does explain why devices with known vulnerabilities remain deployed at scale long after a fix exists.
What happened in France is a direct line from a known flaw, to unpatched hardware, to an attacker who used the flaw as documented. The question of how much access remote systems should have – and how that access is controlled – is pressing hardware makers across categories right now. In this case, the controller’s own firmware handed the attacker the password.
What Comes Next for Connected Commercial Hardware
The financial damage from spoiled perishables across 700 stores is difficult to calculate precisely, but the scale of simultaneous compromise makes the figure significant. Fires at multiple locations add property damage and potential safety liability on top of food loss. French authorities are still working to establish the full scope, and the attackers have not been identified.
For anyone operating Internet-connected refrigeration hardware – or any connected commercial equipment, for that matter – the incident sharpens a question that rarely gets asked before something breaks: who else can reach this device, and what can they do when they get there? The Danfoss firmware was public. The password logic was in the code. The patch cadence, apparently, did not keep up.
Dixell and Copeland have not yet issued public statements addressing the incident directly.
