Whether it was youngsters proving their skills or state sabotage, Europe’s most hacked country was left with a mountain of waste after food began cooking in freezers

The intitial investigation is in.

In a “bizarre and unprecedented” cyber-attack, hackers had remotely overridden the temperature settings on thousands of freezers, fridges and chiller cabinets pushing them from as low as -27C (-16.6F) to well over 50C (122F).

If shop managers first assumed it was an isolated failure, it soon became clear up to 700 stores – including those from the Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix chains along with a number of smaller independent shops – had been victims of a cyber-attack.

The hackers had pirated the controllers supplied by the Danish company Danfoss that controls the freezers and fridges. Most supermarket cold aisles are connected to the internet to allow remote maintenance and alerts for system failures. Initial investigations suggest the hackers disabled alarm systems before tampering with the thermostats, or extended the defrost programme by several hours to avoid triggering alarms.

Danfoss said it had identified security flaws last year and had “long recommended” that customers install updates or replace obsolete unsupported systems. The affected refrigeration units were “running outdated firmware”, it said. In the days following the first wave of attacks, France’s cyber-attack alert centre ANSSI confirmed supermarkets using controllers from two other companies were also targeted.

  • Treczoks@lemmy.worldEnglish
    0·
    3 days ago

    Hacked? This term applied to this is an insult. The user name was “admin”, and the password changed daily - it was the current date.

    This is not hacking, this is a complete and utter failure on behalf of the company who set this up, and their fault entirely.

    • Modern_medicine_isnt@lemmy.worldEnglish
      0·
      2 days ago

      I keep trying to tell the school administration the same thing each time my special needs kid wanders into some gapping security hole and they call it hacking.

    • LesserAbe@lemmy.worldEnglish
      0·
      3 days ago

      Do you have a source on this? The other article I had seen on this said the password changed daily and was algorithmically based on the date. So if someone analyzed past passwords they could derive future passwords, but not that it was literally the date.

      • thallamabond@lemmy.worldEnglish
        0·
        3 days ago

        https://cyberplace.social/@GossiTheDog/117429502412235079

        https://ironhackers.es/en/danfoss-ak-sm-800a-cve-2025-41450/

        The “code of the day”

        Many industrial devices include a service access so the vendor’s technician can get in without the customer’s password. A classic —and dangerous— way to implement it is the code of the day: a code that changes every day according to a formula that, in theory, only the vendor knows.

        The problem shows up when that “secret formula” is the only thing protecting access (security by obscurity) and it can also be recovered from the firmware itself. That is exactly what happens here: sm_app ships unobfuscated, with function and variable names in plain sight. The one that validates the code is called, literally, check_code_of_day.

    • HaraldvonBlauzahn@feddit.orgEnglish
      0·
      3 days ago

      You are right. But also, authentication in a distributed industrial infrastructure is hard, and it is not really a solved problem. You would need to set up a public key infrastructure, giving each shop clerk, service worker, and manager a smart card, revoking them when they leave, recover lost access credentials, and so on. For every class of devices.

      And it gets even more difficult if you want machines to securely talk with each other (think in administering every smart home thing un your house with a smart card…).

      • ripcord@lemmy.worldEnglish
        0·
        3 days ago

        Wtf would each ship clerk need access to remote monitoring of each fridge

        And no, this is absolutely solved

        • HaraldvonBlauzahn@feddit.orgEnglish
          0·
          2 days ago

          this is absolutely solved

          How? According to the EU CRA, each connected device should have unique access credentials. How do you solve that in practice, in an organization like this?

      • Treczoks@lemmy.worldEnglish
        0·
        3 days ago

        No. Controlling and monitoring the fridge and freezer temperature is not something left to non-technical people. Set up a company-wide VPN system, and make it secure. Run those services from a centralized place, with the control systems disconnected from the internet outside the VPN.

        Run separate VPNs for financial systems, orders, company emails, and you are as set as one could expect.

        • HaraldvonBlauzahn@feddit.orgEnglish
          0·
          2 days ago

          I agree that using a VPN is much more secure. And together with not allowing remote temperature control, this would have prevented this specific issue.

          Still, if you have a VPN in a large supermarket chain, you need to manage the access keys - in a way that when one user of the VPN quits the organization, their access is revoked.

          And also, it isnot a good idea that many people share passwords to devices which give administrative rights. So, you should give a unique password to every user, similar as every guest in a hotel gets an NFC card with a unique code.

          The best way I know of to do that would be a PKI and smart cards. This also prevents users from using dumb passwords or using the same ones in multiple places.

          But my impression is that very few organizations like supermarkets do that.

          It gets even more complex with the modern rush to outsource every little thing.

      • ctrl_alt_esc@lemmy.mlEnglish
        0·
        3 days ago

        Not that hard… why was this connected to internet at all? To be able to manage it remotely is a dumb excuse.

        • JohnEdwa@sopuli.xyzEnglish
          0·
          3 days ago

          Makes sense to have them connected for remote monitoring and alarms and such, when a big freezer malfunctions you don’t have much time to save the merchandize before they are all legally unsellable. It’s too late when the morning staff finds everything thawed out. But that should be purely read-only access.

          • ctrl_alt_esc@lemmy.mlEnglish
            0·
            3 days ago

            Yes, it does make sense to have them connected, but not to the internet. They should use a company intranet.

      • BeMoreCareful@lemmy.worldEnglish
        0·
        2 days ago

        Somewhere in France an extremely frightened thirteen year old hasn’t touch anything electronic in a week.

      • yogurtwrong@lemmy.worldEnglish
        0·
        3 days ago

        // TODO: Change this to a time based crypto key deriving algo before release

        char *passwd = curr_date