AI-rewritten: This is a summary of an article from Ars Technica, rewritten by AI (Qwen, running locally) to make it easier to read. The facts come from the original article – read it for the full story.

---

A mass cyberattack recently targeted refrigeration systems in approximately 700 supermarkets across France, causing equipment to malfunction and resulting in spoiled food and fires. French authorities identified the issue as a compromise of Internet-connected controllers used by technicians to remotely manage store-wide systems. Unknown attackers activated defrosters, raising internal temperatures to as high as 50° Celsius (122° Fahrenheit). This failure allowed electricity to overload the electrical systems, leading to fires in some locations.

Security experts note that all three controller models involved—manufactured by Danfoss of Denmark and Dixell/Copeland in the US—contained critical vulnerabilities. These flaws allowed attackers to log in with administrator-level rights using predictable credentials. For instance, Danfoss controllers previously used daily passwords generated from publicly available firmware code, meaning any hacker analyzing the code could replicate the password on unupdated devices. Similar issues existed in Copeland/Dixell controllers fixed only recently.

Researchers at Pen Test Partners stated that two specific security measures would have prevented the breach: removing controllers from the public internet and restricting remote access via a Virtual Private Network (a secure tunnel) and an IP allowlist. They also emphasized patching firmware, changing default credentials, and managing third-party equipment through controlled, documented processes rather than contractor connections. The incident likely cost tens or hundreds of millions of euros and affected countries including Spain, Portugal, Poland, Germany, and Belgium.