Attackers Compromise Danfoss and Dixell Refrigeration Controllers Across Europe
Unpatched controllers exposed to the internet allowed remote access, causing temperature spikes, food spoilage, and fires in hundreds of stores.
Key points
- Unknown attackers compromised internet-connected refrigeration controllers in an estimated 700 European supermarkets, according to French authorities.
- The incident affected devices from Danfoss, Dixell, and Copeland, exploiting critical vulnerabilities that grant administrator-level remote access.
- Affected stores likely lacked VPN protection and IP restrictions, enabling the mass compromise that resulted in significant financial losses.
Unknown attackers compromised internet-connected refrigeration controllers across an estimated 700 supermarkets in Europe, causing widespread system failures. French authorities confirmed that the breach targeted the central controllers managing store-wide fleets of refrigerators and freezers. The attackers activated defrosters for extended periods, raising internal temperatures to 50 degrees Celsius. This malfunction spoiled large quantities of perishable goods and triggered electrical fires in some locations, according to reports from Ars Technica.
What vulnerabilities were exploited?
Public research reports indicate that the compromised controller models from Danfoss, Dixell, and its parent company Copeland contained critical vulnerabilities. These flaws allowed attackers to remotely log in with administrator privileges. Danfoss devices, for instance, used daily credentials generated by publicly available firmware based on the date. Attackers could replicate this password generation on any unupdated device. Because these daily passwords were identical across thousands of stores, the flaw enabled mass exploitation without unique credentials for each location.
How could the attack have been prevented?
Researchers at Pen Test Partners stated that basic cybersecurity measures would have prevented the incident. The affected stores likely failed to place the controllers behind a virtual private network. They also did not implement restricted lists of IP addresses allowed to log in. These standard protections were absent, leaving the devices directly exposed to the internet. Additionally, many stores ran outdated firmware, which contained the critical vulnerabilities that granted remote access to the attackers.
What is the operational impact?
The mass compromise caused immediate physical damage and financial loss across multiple countries. Spoiled food and fire damage likely cost tens or hundreds of millions of euros. The incident affected operations in France, Spain, Portugal, Poland, Germany, and Belgium. The disruption highlights the risks of connecting operational technology directly to the internet without adequate segmentation or access controls. The lack of network isolation allowed the attackers to execute commands that physically altered the state of the refrigeration units.
What steps should organizations take?
Organizations should verify whether their refrigeration controllers are connected directly to the internet. Teams need to check for outdated firmware versions that contain known critical vulnerabilities. It is essential to ensure that such devices are placed behind a VPN and protected by strict IP allow-lists. Suppliers should be contacted to confirm that their products support secure remote administration methods. Without these controls, similar devices remain vulnerable to remote exploitation and physical damage.
Questions to ask your suppliers
Teams usually need to verify if suppliers segment operational technology from corporate networks. Check whether the vendor provides regular firmware updates for critical vulnerabilities. Ask if the devices support strong authentication methods beyond simple or predictable credentials. Determine who within the organization is responsible for monitoring these systems for unusual activity. Ensure that incident response plans include procedures for physical equipment failures caused by cyber events.
What to do and how to stay safe: Danfoss
- Audit all internet-connected operational technology to ensure they are not directly accessible from the public internet.
- Implement network segmentation and virtual private networks to isolate critical control systems from general network traffic.
- Enforce strict IP allow-listing for any remote administrative access to industrial or commercial control devices.
- Monitor vendor security advisories regularly to identify and patch critical vulnerabilities in embedded devices.
Step-by-step guide: Browser Security Settings for Small Business Teams
General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which companies' devices were affected?
The incident involved controllers from Danfoss, Dixell, and its parent company Copeland, according to security reports.
How did the attackers gain access?
Attackers exploited critical vulnerabilities in outdated firmware and predictable daily passwords to gain administrator access.
Was there a financial impact?
The incident likely cost tens or hundreds of millions of euros in spoiled goods and fire damage across several European countries.
