Researchers warned attackers could 'defrost the food' months before French supermarkets got hit

Security researchers warned about exploitable vulnerabilities in refrigeration controllers months - and in one case, more than a year - before cyberattacks disrupted hundreds of French supermarkets. Late Sunday night, unknown criminals hacked thousands of controllers, cranking the heat as high as 122°F (50°C), spoiling food and sparking fires across nearly 700 of the country’s supermarkets. France's national cybersecurity agency ANSSI on Monday warned of widespread compromises involving Danfoss refrigeration controllers, and a day later added affected systems from Copeland and its Dixell brand. The compromised devices were accessible over the internet, with many reportedly no longer receiving software or security updates and others running outdated firmware. Danfoss did not immediately respond to The Register’s request for comment. Copeland emailed us the following statement: “We acknowledge the vulnerability identified in a discontinued, end-of-life generation of controllers. Protecting our customers’ operations has always been a top priority. We are currently working with impacted customers to mitigate the risk. …