700 French supermarkets hacked via fridge controllers with passwords the firmware reveals

The number is real: an estimated 700 supermarkets across France had their refrigeration systems hacked this week, and the attack vector was as mundane as it was devastating. French authorities say Internet-connected controllers, the devices technicians use to remotely administer a store's entire fleet of refrigerators and freezers, were compromised by unknown attackers who activated defrosters long enough to push temperatures as high as 50°C (122°F). The result: untold tons of spoiled perishables and, in some cases, electrical systems that caught fire.

The password problem is the part that should make every operator wince. Security advisories and public research reports show that all three controller models reportedly hacked, Danfoss of Denmark and Dixell with its parent company Copeland in the US, contain critical vulnerabilities that allow attackers to remotely log in with the same system rights as administrators. The most striking flaw: Danfoss controllers used a credential that changes each day, but the password is generated by the publicly available firmware based on the date. A hacker who takes the time to analyze the code can do the same thing on any device that hasn't received a recent update, and the daily passwords are identical across models located in hundreds or thousands of stores.

This is the quiet catastrophe of operational technology: the systems that keep physical infrastructure running are increasingly connected to the Internet for convenience, and the security often hasn't caught up. Commercial refrigeration is critical infrastructure hiding in plain sight. Supermarkets, cold storage warehouses, and food distribution centers depend on these controllers running 24/7, and a compromise doesn't just mean a warm aisle. It means spoiled inventory, lost revenue, insurance claims, and in the worst case, fire. The fact that these devices were exposed to the Internet at all is the deeper problem, and the source is blunt: basic cybersecurity would have prevented it.

The scale of the exposure makes it worse. Because the daily password is identical across models in hundreds or thousands of stores, one analysis of the firmware effectively unlocks an entire fleet. This is a supply-chain scale vulnerability: a single attacker who does the reverse-engineering work once can replay it against any store running unpatched controllers. The attackers here remain unknown, and the discovery came only after food was spoiled and, in some cases, electrical systems caught fire. The pattern, however, is familiar. Remote administration is a convenience that becomes a liability when devices are exposed without proper authentication, network segmentation, or monitoring.

The business math is brutal for any operator. Supermarkets typically carry significant perishable inventory, and a store-wide refrigeration failure at 122°F does not just ruin the stock on the shelves. It can mean lost sales, insurance claims, and reputational damage that outlasts the cleanup. For context, connected industrial devices have historically been built for reliability and convenience, not security, which is exactly how controllers with predictable credentials end up exposed to the Internet in the first place. The cost of a spoilage event plus fire damage across 700 locations dwarfs the cost of basic security hygiene, which is why the source's verdict lands so hard.

For executives, the lessons are immediate. Any operation running connected industrial equipment, from supermarket chains to cold chain logistics to restaurant groups, should treat this as a direct warning. The first step is inventory: know which devices are on the network and which are reachable from the public Internet. The second is hygiene: change default credentials, patch or replace end-of-life hardware, and segment networks so controllers are not directly exposed. The third is monitoring: a defroster activation that pushes temperatures to 122°F should trigger an alert, not a discovery after the fact.

The strategic stakes go beyond France. This hack is a preview of a broader class of risk: operational technology is the next frontier for attackers because it is both valuable and under-defended. The fridge attack is notable precisely because it is not exotic. It is mundane: predictable credentials, exposed devices, and no monitoring. For any board or CEO, the question is not whether your industry will be targeted, but whether your devices are the ones with the publicly derivable password.