Security Firm Warns On Refrigeration Asset Security

TL;DR

Before you orderOffer from Amazon

Get backup power and energy gear delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security firm Claroty has warned food retailers not to assume refrigeration controllers are isolated after a cyberattack reportedly affected hundreds of French supermarkets. It urges operators to identify internet-exposed devices, update supported firmware and restrict access; the number of vulnerable systems still exposed is unknown.

Cybersecurity firm Claroty has warned food retailers to check whether their refrigeration controllers are exposed to the internet, following a reported cyberattack on French supermarkets that involved changes to refrigeration settings. The warning matters because controllers used to manage physical temperatures may be reachable through weak credentials, insecure configurations or flaws in older communications protocols, Claroty said.

Claroty said publicly available scanning services, including Censys and Shodan, can identify internet-connected operational technology and help attackers find potential targets. The company urged supermarkets, cold-storage operators and other organisations dependent on refrigeration to inventory their equipment, check for direct internet exposure and restrict administrative access to trusted network segments or secured remote-access systems.

Claroty’s Team82 research group said its initial scan for exposed Danfoss AK-SM800A controllers found 2,765 devices. The firm said it does not know how many have since received updated firmware or remain exposed to the vulnerabilities Team82 identified. That figure describes the initial scan, not a confirmed count of devices still vulnerable.

In August, Team82 disclosed vulnerabilities in controllers from Danfoss and Copeland that it said could let attackers manipulate physical temperature systems. Both manufacturers swiftly released patches, according to the report. Danfoss has since said some affected AK-SM800A systems involved in the French incident were running outdated firmware.

Refrigeration Controls Can Reach Beyond Stores

A compromise of refrigeration controls can affect more than the confidentiality of data: these systems regulate temperatures that protect food and other temperature-sensitive goods. The reported French incident involved attackers taking control of refrigeration systems and changing settings, with produce reportedly defrosted in hundreds of supermarkets. Those details were reported by Cooling Post; the full scope and consequences have not been independently established in the material provided.

Claroty also warned that an exposed controller could serve as a route into wider operational or enterprise networks. Its advice is to secure credentials, maintain visibility over connected assets and segment networks so a compromised device has less access to other systems. For retailers, the potential stakes include disrupted operations and damage to temperature-sensitive stock; the extent of any losses from the French attack remains unclear.

The warning applies beyond supermarkets. Cold-storage facilities, food manufacturers and healthcare or commercial organisations may also depend on refrigeration systems that are connected to broader networks. Claroty says operators should treat these devices as assets requiring active security, rather than assuming they are protected because they control physical equipment.

French Attack Followed Controller Research

Cooling Post reported that the supermarket cyberattack occurred on Sunday night, October 11, and that attackers were reported to have taken control of refrigeration systems in hundreds of French stores. On October 12, Danfoss said it was in close contact with supermarket customers affected by the incident. The available report does not identify the attackers or establish how they gained access.

The incident came after Team82’s August disclosures about Danfoss and Copeland controllers. Both manufacturers released patches, but a patch being available does not establish that every affected system has been updated. Danfoss has long advised customers to update supported systems and move away from legacy equipment to current-generation solutions, according to the report.

Claroty connected its warning to the ease of finding exposed devices online and to the possibility that attackers could use scanning and vulnerability discovery tools more quickly. It also pointed to increased activity against critical infrastructure amid geopolitical conflict. These are the firm’s stated risk concerns; the report does not establish that artificial intelligence or geopolitical activity played a role in the French supermarket attack.

“Team82’s initial research into exposed Danfoss AK-SM800A devices turned up 2,765; it’s unknown how many of those assets have since deployed the updated firmware, and how many remain exposed to these particular vulnerabilities.”

— Claroty’s Team82 research group

The Scale of Exposure Is Unknown

The source material does not establish how many controllers remain exposed, how many have been patched or whether the 2,765 devices found in the initial scan were all vulnerable. It also does not provide a confirmed count of supermarkets affected, the value of any damaged stock or a complete account of service disruption.

The method used to access the French retailers’ systems, the identity of the attackers and whether the incident involved the vulnerabilities disclosed in August have not been confirmed in the supplied reporting. Danfoss said some affected systems were running outdated firmware, but that information alone does not explain how attackers entered the networks or establish that outdated firmware was the cause.

Retailers Urged to Audit Connected Systems

Claroty’s immediate recommendation is for operators to inventory refrigeration assets, determine which are directly internet-facing and restrict administrative services to trusted network segments or secure remote-access solutions such as a VPN or industrial remote-access system. It also recommends reviewing credentials, system visibility and network segmentation.

Organisations using supported equipment should check firmware status and apply vendor updates where appropriate, while Danfoss has advised migrating legacy systems to current-generation solutions. The available report does not specify a deadline for these checks or describe a new government or industry response. Further information about the French incident, the affected systems and any continuing customer response may clarify how the attack was carried out and how many sites were affected.

Key Questions

What did Claroty warn retailers about?

Claroty warned that refrigeration controllers may be reachable from the internet and should not be assumed to be isolated. It urged organisations to identify exposed equipment and restrict administrative access.

How many Danfoss controllers did Team82 find?

Team82 said its initial research found 2,765 exposed Danfoss AK-SM800A devices. Claroty said it does not know how many have since been updated or remain exposed to the vulnerabilities it identified.

Were the August controller vulnerabilities confirmed as the cause of the French attack?

No. The supplied reporting does not confirm that the French attack used those vulnerabilities. Danfoss said some affected systems were running outdated firmware, but the attackers’ method has not been established.

What should organisations do about refrigeration controllers?

Claroty advises operators to inventory devices, check internet exposure, secure credentials and limit network access. Danfoss has also advised customers to keep supported systems updated and migrate legacy equipment.

Source: rss