Industrial Refrigeration Controller Unauthorized Access and Temperature Tampering

Multiple European supermarket chains in Belgium, Sweden, Ireland, the Netherlands, Finland, Italy, Portugal, and Estonia have reported targeted attacks on industrial refrigeration controllers. Attackers are gaining unauthorized access to internet-reachable management interfaces of Danfoss and Copeland/Dixell devices, forcing evaporators into defrost mode, which results in significant temperature increases and food loss. Experts confirm many targeted units are legacy, end-of-life devices lacking vendor patches. Initial findings indicate usage of publicly documented factory-default credentials to gain entry.

Attack Chain

1. Reconnaissance: Attackers identify internet-exposed refrigeration management interfaces (e.g., Danfoss StoreView).
2. Initial Access: Attackers authenticate to the management interface using known factory-default credentials.
3. Execution: Attackers modify controller settings to force the refrigeration unit into an active defrost cycle.
4. Impact: The cooling mechanism is overridden, causing internal unit temperatures to rise (up to 50°C), resulting in spoiled food and potential fire hazards.

Impact

Over 100 stores across Europe have been affected, including major retailers like Delhaize, Carrefour, and Spar. Reported impacts include massive food spoilage, financial losses for small and large grocers, and operational disruption to the regional food supply chain.

Recommendation

• Identify and inventory all internet-facing refrigeration management systems (specifically Danfoss AK-SM, AK-SC series, and Copeland/Dixell XWEB systems).
• Immediately remove industrial refrigeration controllers from the public internet.
• Implement strict network segmentation and place controllers behind a secure VPN or firewall requiring multi-factor authentication for access.
• Audit all management interfaces for the use of default factory credentials and replace them with unique, strong passwords.
• For end-of-life units that cannot be patched, apply physical isolation or replace the controller with modern, supported hardware.