Fridge hack costing millions and sparking fires stemmed from poor security
Poorly secured supermarket refrigeration controllers were mass-hacked, causing fires and huge reported losses across Europe.
Researchers say a mass compromise of poorly secured supermarket refrigeration controllers caused fires and likely cost tens or hundreds of millions of euros. Affected stores reportedly left outdated controllers on the public internet without VPNs, IP allowlists, changed default credentials, or current firmware. Spain, Portugal, Poland, Germany, and Belgium were reportedly affected. Copeland acknowledged a vulnerability in a discontinued end-of-life controller generation, and Danfoss was also cited as referring to discontinued models. The attacker has stayed silent, leaving vandalism or a state-linked disruption among the speculated motives.
- Internet-exposed refrigeration controllers with weak access controls were mass-hacked.
- Researchers cite missing VPNs, IP allowlists, credential changes, and patches.
- Copeland and Danfoss pointed to discontinued end-of-life controller models.
- Spain, Portugal, Poland, Germany, and Belgium were reportedly affected.
- The attacker has not been identified and the motive remains unclear.
Full article321 words · extracted from arstechnica.com · click to collapse
Besides running controllers with outdated firmware, the affected stores likely also failed to put the devices behind a VPN and create a restricted list of IP addresses allowed to log in. These protections are standard but often not followed. In this case, that failure enabled a mass hack that likely cost tens or hundreds of millions of euros. Spain, Portugal, Poland, Germany, and Belgium were also reportedly affected.
“Two things would have changed the outcome,” researchers at Pen Test Partners said Wednesday. “Cyber hygiene would have prevented the access: take the controller off the public internet, put remote access behind a VPN and an IP allowlist, bring third-party kit onto the network in a controlled, owned and documented way rather than leaving it on a contractor’s own connection, change known and default credentials, and patch to a current release.”
Researchers from security firm Claroty warned of the threat of ignoring these common-sense steps last October. The US Cybersecurity and Infrastructure Security Agency did the same in February.
In an email, Copeland acknowledged a vulnerability “identified in a discontinued, end-of-life generation of controllers” and said the company is working with customers to prevent similar incidents in the future. Danfoss representatives didn’t immediately respond to questions. CNN said the company also cited discontinued models.
So far, the party behind the attack has remained silent. That raises the possibility that the motive was vandalism on a mass scale. Another possibility is a nation-state or other international actor aiming to create a continent-wide disruption.
The incident underscores the tension between the financial and security departments in most businesses. Some companies are loath to spend large sums of money on new equipment when there are no tangible benefits or savings. Only after a devastating hack do they realize why the investment was worthwhile. Executives at affected supermarket chains will likely learn the hard lessons. Less clear is whether the cautionary tale will sway other businesses.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arstechnica.com/security/2026/10/fridge-hack-costing-millions-and-sparking-fires-stemmed-from-poor-security/