Does this concern you?
- Affected directly: shops and food businesses whose refrigeration controllers are reachable from the internet. In France, the cyber agency reported compromised remote-control modules from Danfoss and Copeland.
- In our view, the lesson reaches further: any company with a service open to the internet that only a login protects – a website admin page, a NAS, remote desktop, cameras, or a device a contractor manages.
- Skip it if: nothing of yours, contractor devices included, is reachable from the internet except via a VPN or fixed IP addresses.
What to do
- List what is reachable from the internet: port forwards on your firewall or router, and every device a contractor connects to remotely.
- Anything protected only by a password: move it behind a VPN or allow only specific IP addresses. For the refrigeration controllers, France's CERT-FR advised taking them off the internet or strictly filtering access.
- Refrigeration specifically: ask the installer which controller you have. Danfoss AK-SM 800 and AK-SC 355 get no security updates; Danfoss advises migrating them. For the AK-SM 800A, have last year's patch confirmed.
- Signs of this attack were units switched to defrost or temperatures staff could not set back; installers then disconnected the units from the network. An Estonian service firm said reacting within 10 minutes limited the damage.
What we know – and what we don't
- Hit chains include Delhaize, Carrefour and Spar in Belgium and ICA and Coop in Sweden; in Ireland, Musgrave pulled chilled and frozen food from 13 SuperValu stores.
- Claroty showed last year that the end-of-life Danfoss models expose a login with the user name "admin" and a daily code derived from the device date. After the French attack, Reuters counted at least 4,500 Danfoss interfaces online.
- In Estonia, service firm Kitman Coldtech says attackers got into an older Danfoss controller. Whether the Belgian and Swedish stores run the same equipment is not confirmed; Sabcobel says the method is exactly the same as in France.
- Nobody has claimed the attacks and no ransom demand has been reported.
- ICA says the hit stores' connections sit outside its central network.
Why it matters
A login page that faces the internet can be found by anyone who looks for it; without a second factor, the password is the only thing in the way. On the old Danfoss models, it is a code worked out from the date. Freezers are the extreme case; the check applies to every admin page you run.