What if the Next Attack isn’t to Set Refrigerators on Fire?
As Thousands of French Refrigerators Became Ovens, A bigger Problem Exists.
Last weekend, thousands of refrigerators in French supermarkets all of a sudden became ovens. Instead of storing food at around 35 degrees, some of them went up to over 100 degrees. Millions of dollars of food had to be thrown away. Some of the units actually caught fire.
THIS TIME, the attackers targeted units from Danfoss, Copeland and Dixell.
About 350 Danfoss AK-SM units were still exposed as of Wednesday which is down from about 550 earlier this week. Researchers said 1,173 Copeland XWEV Pro and Evo units remain exposed.
Census said that more than 2,900 Danfoss StoreView Panel hosts are still exposed. Security Scorecard says their search pulled up over 5,200 StoreView instances visible.
Combine the fact that these units are visible on the Internet with the fact that the developers did not design these systems with security in mind and you have a problem. After all, when was the last time you patched your refrigerator?
The bugs that allowed the compromise were disclosed by security researchers in August. Researchers originally alerted Danfoss about the bugs in 2025. The manufacturer did patch the bugs and also issued additional guidance.
Oh, yeah, the vulnerability was in DISCONTINUED END-OF-LIFE CONTROLLERS.
Does that mean that these supermarkets had installed the patches? Unknown.
Multiply that by every other connected devices in use anywhere. It is reasonable to assume that most of them are in a similar condition.
In what security universe would you directly connect your refrigeration system to the Internet? In one where security plays second fiddle to convenience!
The good news is that in this case all it did was ruin a few million dollars of food and set some refrigerators on fire.
What if, next time, it isn’t refrigerators but instead they were medical devices like infusion pumps. Or water treatment plants. Some of the attacks on water treatment plants just turn up or down the chemical numbers. What if the attack DAMAGED the system so there was no water. We have seen attacks on power plants that damaged the power plant so there was no power until it was repaired. There are thousands of examples. Dams have control systems. Hospitals have thousands of online devices. These people who attacked, of all things, refrigerators, were not trying to make a country panic. But what if the next one does?
Need assistance, please contact us.
Credit: Cybersecurity Dive
by 