Attackers compromised internet-connected refrigeration controllers across an estimated 700 French supermarkets this week, pushed cabinet temperatures to 50° Celsius (122° Fahrenheit), and left untold tons of spoiled food and, in several stores, electrical fires. French authorities say the intruders breached the remote-administration systems that technicians use to manage store-wide fleets of refrigerators and freezers, then simply ran the defrosters until the contents cooked.

The bill will run into the millions. So will the questions, because none of this required a sophisticated adversary.

Which devices were hacked, and how?

Three controller models were reportedly compromised, according to multiple security advisories and public research reports — devices sold by Danfoss of Denmark and by Dixell and its US parent company Copeland. All three, the advisories show, contained critical vulnerabilities that let attackers remotely log in with full administrator rights. No zero-days. No chains. Just login.

Danfoss's case is almost embarrassing. Until recently, its controllers used a daily credential generated by publicly available firmware based on the date. Anyone willing to read the code can reproduce the password on any device that hasn't received a recent update. Worse, the daily password is identical across models deployed in hundreds or thousands of stores — so one reversing session unlocks a fleet.

The US Cybersecurity and Infrastructure Security Agency has published advisories covering the affected industrial control systems, flagging the severity of the remote-access flaws.

What does the attack tell us about supply-chain security?

The commercial refrigeration market runs on cheap, long-lived, networked controllers bolted onto equipment designed to survive a decade or more in a store. Vendors ship them with firmware few retailers ever update, and the units sit on networks with admin-level remote access as a standard feature.

That combination — public firmware, predictable credentials, fleet-wide reuse, and remote reach — turned one product family's weak design into a national-scale single point of failure across France's grocery sector. The attackers didn't need to defeat a defense. They needed only to find the door left open.

For supermarkets, the incident reframes the cost equation. A controller-refresh and credential-hardening program that once looked like IT overhead now competes directly with the price of restocking an entire refrigerated aisle — or rebuilding one after a fire.

Could basic cybersecurity have stopped it?

Yes, and that's the part security professionals keep repeating. As reporting on the incident noted, basic cybersecurity would have prevented the attack — the standard playbook applies:

• Change or disable vendor-default and date-derived credentials
• Isolate refrigeration controllers from the open internet and restrict remote administration to VPN access
• Apply vendor firmware updates promptly to affected Danfoss, Dixell and Copeland models
• Monitor for anomalous defrost-cycle activation and out-of-range cabinet temperatures

The attackers remain unidentified, and French authorities are still investigating. But the mechanism is already fully documented in public advisories, and until operators of the affected controllers patch or isolate them, the same attack path stays open across every store still running unupdated firmware.