Earlier this week, attackers knocked out refrigeration systems in roughly 700 supermarkets across France. Tons of perishable food spoiled, and in some stores the overheating set off electrical fires.
What happened
The attackers got into internet-connected controllers that technicians use to administer a whole store's fridges and freezers remotely. They switched on the defrosters long enough to push temperatures up to 50°C (122°F). By the time anyone noticed, the stock was ruined.
It was preventable
All three controller models reportedly hit, sold by Danfoss and by Dixell and its parent Copeland, had critical flaws that let outsiders log in with administrator rights. Danfoss units, for example, used a daily password, but it was derived from the date by publicly available firmware. Anyone who studied the code could work out the password for any device missing a recent update, and it was identical across hundreds or thousands of stores.
Takeaway
This wasn't a clever attack. It's a reminder that industrial gear sitting on the open internet without updates will eventually fail someone.