Fridge hack costing millions stemmed from basic security lapses

A mass hack of refrigeration controllers in European supermarkets has likely cost tens or hundreds of millions of euros, and the article's headline also links it to fires. According to Ars Technica, the affected stores probably ran controllers with outdated firmware. They also appear not to have placed the devices behind a VPN (an encrypted remote-access connection) or created a restricted list of IP addresses permitted to log in. These protections are standard but often neglected. Spain, Portugal, Poland, Germany and Belgium were reportedly affected as well.

What researchers say

Researchers at security firm Pen Test Partners said on Wednesday that two things would have changed the outcome. The first is cyber hygiene: take controllers off the public internet, put remote access behind a VPN and an IP allowlist, bring third-party equipment onto the network in a controlled and documented way, change known and default credentials, and install current updates.

Security firm Claroty warned about ignoring such steps last October, and the US Cybersecurity and Infrastructure Security Agency (CISA) did so in February.

Manufacturers respond

Controller maker Copeland acknowledged a vulnerability in a discontinued, end-of-life generation of controllers and said it is working with customers to prevent similar incidents. Danfoss did not immediately answer questions; CNN reported that the company also pointed to discontinued models.

Motive unclear

The party behind the attack has stayed silent. That leaves open the possibility of large-scale vandalism, or of a nation-state or other international actor seeking continent-wide disruption.

The incident highlights the tension between finance and security departments: some companies are reluctant to spend heavily on new equipment without tangible benefits. Executives at the affected chains will likely learn hard lessons, but it is unclear whether other businesses will heed the warning.