Wait, you can hack a freezer?
That was most people’s reaction when France blamed Iran this week for breaking into hundreds of supermarket refrigeration systems. You can, it turns out, and the way it happened is a useful lesson in where the real weaknesses of connected equipment sit.
What the attackers did, in three moves
Overnight on 11-12 October, the attackers hit the refrigeration controls of more than 700 retail sites, according to France’s formal attribution. They got in through the web interfaces of Danfoss and Dixell controllers – the small industrial computers that keep fridges and freezers at temperature, per the Paris prosecutor’s office
Then they did three simple things. Started abnormal defrost cycles with no time limit. Switched off the temperature safety alerts. Walked away.
The result: food worth tens of millions of euros ruined, and around 20 fires.
Why a freezer is an easy target
Industrial controllers are built for reliability, not security. Many run for years on default passwords and old firmware, with their management pages reachable from the open internet. Nobody gives a fridge a security update every month. And scanners like FOFA – the tool the attackers used, per the French investigation – let anyone find exactly these exposed devices in seconds.
Freezers were not even the whole of it. The same report ties the attackers to snooping on Schneider Electric equipment at small hydroelectric and water sites. Anything with a control panel and a connection is on the list.
If you run a business, any business
You do not need to be Carrefour for this to matter. Butcher shops and a slaughterhouse were among the victims.
So, the practical bit. Find every device you own that has a web interface; you cannot protect what you have not inventoried. Change default passwords, switch on multi-factor login where it exists, and keep management pages off the public internet behind a VPN. Update firmware on a schedule rather than when something breaks. And make sure safety alerts – like the temperature alarms silenced here – cannot be switched off remotely without a second approval.
An afternoon’s work, most of it.
The bottom line
This attack worked because nobody thinks of a freezer as a computer. Everything with a chip and a connection is a computer now, and attackers scan for the forgotten ones first. An hour spent counting your connected kit is the cheapest security you will ever buy.
