A large-scale hacking incident targeting refrigeration and freezing equipment across France has raised alarms about the security of domestic food distribution facilities. Outdated control devices with discontinued security updates and remote management systems directly exposed to the internet are identified as key risk factors.
According to the French National Agency for the Security of Information Systems (ANSSI) on the 14th, cyberattacks targeting refrigeration and freezing equipment compromised remote control devices from multiple manufacturers, including Danfoss's AK-SM·AK-SC series and Copeland·Dixell's XWEB series.
Recently, refrigeration and freezing equipment has been providing features to check equipment status and change settings via the internet through remote control, which was exploited as an attack vector.
The damage occurred over two days, from the 11th to the 12th, affecting approximately 700 large supermarkets and stores in France. Hackers manipulated the defrosting function, increasing operation time from 1 to 8 hours and raising equipment temperatures. As a result, internal temperatures soared to 80°C, leading to mass food disposal and business interruptions. Reports suggest the damage amounted to tens of millions of euros.
This incident is presumed to have exploited already known vulnerabilities, with criticism pointing to poor management as the root cause.
Claroty, a U.S. industrial control system security company, disclosed vulnerabilities in Danfoss control devices in August, including bypassing administrator authentication and remote command execution. They also discovered 23 vulnerabilities in Copeland XWEB Pro and successfully conducted experiments remotely manipulating refrigerators' cooling functions.
Manufacturers provided security updates, but delays in response led to the incident. It was reported that outdated equipment unable to receive firmware updates was also targeted.
Additional damage is feared as numerous remote control devices for refrigeration equipment remain exposed to the internet without security measures.
Reuters reported that Shodan, an internet search service, identified at least 4,500 Danfoss management interfaces exposed externally. French security firm Onyphe analyzed that only a small portion of these devices appeared to use the latest software.
If South Korean large supermarkets, logistics centers, and pharmaceutical storage facilities have remote control devices directly exposed to the internet with insufficient security updates, they could suffer similar damage. The scale of vulnerable equipment in South Korea remains unconfirmed.
ANSSI recommended, “Block direct internet exposure, apply updates, and use protected pathways such as VPNs for remote access.”
