Outdated refrigeration controllers exposed to the public internet helped attackers hit about 700 supermarkets in a cyberattack that reportedly sparked fires and may have caused losses in the tens or even hundreds of millions of euros. The affected stores were in Spain, Portugal, Poland, Germany and Belgium, according to reports cited by security researchers. A fridge controller is not supposed to become the most consequential device in the building. Here we are.
Researchers at Pen Test Partners said the stores likely left the controllers without basic protections: remote access through a VPN, a restricted list of approved IP addresses, changed default credentials and current software. Some devices were also connected through contractors’ networks rather than being brought onto the supermarkets’ networks in a controlled, documented way.
“Two things would have changed the outcome,” the researchers said Wednesday, before listing several things. The gist: don’t leave old equipment open to anyone on the internet, and don’t let third-party devices wander onto a corporate network without clear ownership and controls. These are not exotic defenses. They are the digital equivalent of locking the delivery entrance, a measure whose main drawback is that it costs money before anything goes wrong.
Security firm Claroty warned about the risks of ignoring those precautions last October. The US Cybersecurity and Infrastructure Security Agency issued a similar warning in February. The attack is an ugly demonstration of the gap between publishing advice and getting organizations to act on it—particularly when the vulnerable equipment is out of sight, humming away in a plant room.
Copeland acknowledged a vulnerability in a discontinued, end-of-life generation of controllers and said it is working with customers to prevent similar incidents. CNN reported that the company also pointed to discontinued models. Danfoss representatives did not immediately respond to questions. The available information does not establish exactly how the attackers used the vulnerability or who they were.
That last part matters. The attackers have not publicly claimed responsibility, leaving their motive unclear. The incident could have been vandalism on a vast scale; researchers also raised the possibility of a nation-state or another international actor seeking wider disruption. Those are possibilities, not confirmed explanations.
Replacing aging equipment can be an expensive, unglamorous budget fight, especially when the security benefit looks like an incident that hasn’t happened yet. But a controller connected to the internet is still a computer, even if it lives beside a freezer and nobody in the boardroom has ever seen it. The bill for treating it otherwise may now run into the hundreds of millions. Apparently, “we’ll patch it later” is still a popular way to finance a very expensive lesson.
Sources: Glitch Please! and Ars Technica — https://arstechnica.com/security/2026/10/fridge-hack-costing-millions-and-sparking-fires-stemmed-from-poor-security/ — Source reporting on the supermarket controller attack and researcher and company statements.
Generated by AI
