Hackers Turned French Supermarket Freezers Into Ovens. The Fix Is 'Change the Password'

Most cyber-attacks steal your data. This one cooked your dinner, slowly, overnight, in the frozen-food aisle.

What happened

Hackers took control of the systems that run refrigeration at hundreds of French supermarkets and forced fridges and freezers to heat up instead of cool down. Les Mousquetaires, which owns Intermarché, said about 150 of its stores were hit, with fridges heated to 50C (about 120F) for six hours, The Guardian reported. The Paris prosecutor’s office called it a large-scale cyber-attack affecting connected refrigerators at several major food retailers, with food losses and fires reported.

The BBC said Coopérative U, Intermarché and its Netto brand, Carrefour, Monoprix and E.Leclerc were among the chains affected. Managers arriving on Monday morning were met by a wave of hot air from the freezers, and some stores had small fires. Intermarché threw away all the affected food to avoid health risks. France’s finance minister, Roland Lescure, later told Parliament that about 700 of the country’s 10,000 supermarkets were affected, AP reported. He said there was no risk to France’s food supplies, but that the attack “touches the heart of our food security.”

How it worked

Supermarket fridges normally run a short defrost cycle each night. According to the BBC, the attackers ordered the units to heat up and stay hot. The systems targeted ran software from Danish engineering firm Danfoss, and France’s national cyber-emergency team, CERT-FR, also listed controllers from Copeland and Dixell.

Danfoss said many of the affected units had “reached end of life and no longer receive software or security updates” or were “running outdated firmware,” NBC News reported, citing Reuters. Experts told Reuters the attack appeared easy to pull off. The control panels can be reached over the internet so maintenance companies can tweak them from anywhere, and Reuters found at least 4,500 Danfoss interfaces still visible online the day after.

CERT-FR’s advice reads like the first page of a home Wi-Fi manual. Don’t expose management interfaces to the internet. Update the firmware. Make sure the default passwords have been changed. It also warns that a factory reset on its own won’t help if the device is out of support, because it will simply get hacked again.

The Snark take

For years we’ve been told that the “smart fridge” was the future. It turns out the future arrived in the frozen peas aisle, and it shipped with the factory password still on.

The attack wasn’t clever. It worked because thousands of expensive machines were left on the open internet with old software, so whoever handles maintenance could log in from home. So could anyone else. No group had publicly claimed responsibility in the first days afterwards, and prosecutors have opened a cyber-crime investigation.

The lesson is the one the IT department has been shouting about for twenty years. If something is plugged into the internet, someone has to own updating it. That goes for a laptop, a doorbell or an aisle of freezers full of fish fingers. Otherwise you’re running a very expensive oven, on somebody else’s schedule.