FBI warns of more fridge hacks after European attacks

On November 2, hackers remotely pushed up freezer temperatures in dozens of supermarkets across at least 11 countries, some as high as 50 degrees Celsius. Investigators and researchers say the attackers needed very little skill to do it. The overnight attack came three weeks after a similar one hit hundreds of French stores. It struck chains including Carrefour and Delhaize in Belgium and ICA and Coop in Sweden, and stores had to throw out spoiled food. Ahold Delhaize Koninklijke Ahold Delhaize N.V., IKEA and Colruyt Group were also hit, with systems in Belgium, Luxembourg, Sweden and the Netherlands affected.smh.com.au+2

Open doors and factory passwords

Many controllers sat on the open internet, protected by default passwords or running old software. In France, Vincent Strubel, head of the national cyber agency ANSSI, told the Senate that controllers had no firewall and that their admin screens were guarded only by weak passwords. A spokesperson for Danfoss told Dutch broadcaster NOS that the Dutch systems hit were not on a secure network and still used their default passwords. Danfoss said most of the affected units were older products that no longer get security updates, and Copeland pointed to a flaw in discontinued controllers.apnews.com+2

SecurityScorecard looked at one compromised Copeland unit. In the early hours of November 2, administrator sessions made 743 changes to 31 devices, including turning off alarms. "The attackers needed no vulnerability, only the default credentials," wrote researcher Massimo Giaimo.helpnetsecurity.com

AI lowers the bar

Claroty, a security firm, published flaws in Danfoss controllers earlier this year. After the French attack in October, it tested how fast an AI coding agent could rebuild them. Using public firmware and analysis tools, the agent reached root access on a test device in about 28 minutes, for roughly $6 in usage costs. The researchers said a person still had to step in when the agent took the wrong approach. They also stressed that the test reproduced known flaws rather than finding new ones.fr.claroty.com+1

Who did it, and what now

No group has claimed the attacks or asked for ransom. France's foreign minister has blamed Iran for the hacks. A researcher at SentinelOne ↘ 0.89% said groups aligned with Russia are also possible suspects. The FBI and other US agencies have urged operators to take controllers off the public internet and change default passwords. In the UK, 274 supermarket refrigeration controllers can still be reached from the open internet.thegrocer.co.uk+2

"Change the default password and keep these systems off the open internet, and almost all of this goes away," said Bassill of UK Cyber Defence.thegrocer.co.uk