An incident at hundreds of French supermarkets exposed a quiet but serious weakness in industrial food infrastructure: refrigeration controllers accessible over the public internet with default usernames and date-based passwords. The scale of food loss, reported in the millions of euros, came from systems that were already accessible before any attacker arrived.<\/p>\n
Hundreds of supermarkets in France had their refrigeration systems manipulated in a single coordinated event. Temperatures inside display cases and storage freezers were pushed as high as 50 degrees Celsius, forcing widespread disposal of spoiled stock. Reports put the resulting food losses in the millions of euros, with additional stores in other European countries also affected.<\/p>\n
Investigators traced the attack surface to specific controller hardware: Danish-made Danfoss AK-SM800 and AK-SC355 regulator systems used to manage store refrigeration. These panels were designed to be reachable over the internet so they could be adjusted and maintained remotely.<\/p>\n
The credential configuration on the controllers turned remote access into open access. The login was set to a default username and a password that matched the current calendar date, refreshed each day. Logging in with that day’s password was not a bypass. It was the intended path, left unprotected.<\/p>\n
Basic credential hygiene is the first line of any cybersecurity posture. When the username is a factory default and the password is the date itself, a successful login requires no exploit chain, no malware, and no specialized expertise. Automated tools now scan the internet continuously for exactly these conditions: default logins, unpatched firmware, and exposed control interfaces.<\/p>\n
The wider point is that the same exposure pattern exists across industrial control systems far beyond retail refrigeration. Refinery controls, oil pumping stations, water treatment plants, power-grid components, airport systems, and logistics networks all run on programmable logic controllers, and many of those controllers are still connected to the public internet with outdated or default credentials. Reports from U.S. federal authorities have documented hackers linked to Iran using these exposed controllers to disrupt oil, gas, and water infrastructure.<\/p>\n
Calling the French incident a cyberattack in the national-security sense misses the real failure. Operators connected critical controls to the internet, prioritized convenience over security, and expressed surprise when unauthorized access followed. As automated scanning tools become cheaper and faster, the number of reachable, unhardened controllers only grows.<\/p>\n
A single compromised thermostat would normally be a single-store problem. The reason this became a regional supply disruption is that hundreds of stores ran the same model of regulator from the same manufacturer, on the same exposed control interface, configured the same way. That shared stack is what specialists call a monoculture: one vulnerability applied uniformly across a fleet. Whoever the attacker turned out to be, they did not need to break in 150 times. They needed to break in once and replicate.<\/p>\n
This is a food-supply problem, not a hacking problem. Centralized internet-connected systems concentrate risk. Independent refrigeration, local food production, and power sources not tied to a single vendor limit how far a single compromise or mechanical failure can spread.<\/p>\n
The broader risk is not limited to grocery shelves. The same exposure pattern shows up in cloud infrastructure, which was targeted for the first time in a military context when commercial data center facilities in the UAE and Bahrain were struck by drones. Centralization creates attractive targets whether the threat is a default password, a missile, or a storm.<\/p>\n
The useful frame is to treat the French freezer incident as a preview rather than an outlier. Owners and integrators of refrigeration and other industrial control systems should know exactly which of their devices are reachable from the internet, what credentials protect them, and how long it has been since those credentials were changed. Where possible, customers can ask retailers and suppliers what they have done to keep the cold chain under local control.<\/p>\n
For any business that depends on internet-connected systems for revenue or operations, a practical starting point is to pull an inventory of externally reachable assets and their login details. SEOScanPro’s website audits include checks for exposed endpoints and credential patterns on web-facing services, which is a starting point for the parts of a stack the public actually sees.<\/p>\n
Attackers manipulated Danfoss AK-SM800 and AK-SC355 refrigeration controllers at hundreds of stores. These systems were connected to the internet for remote management and were protected by default usernames with passwords that changed daily to the current date.<\/p>\n
Reports put the losses in the millions of euros across the affected French supermarkets and stores in additional European countries.<\/p>\n
Investigators have not publicly identified the attackers. The technical details, default credentials on internet-exposed controllers, do not require nation-state capability. Automated scanners find and log into systems like this continuously.<\/p>\n
Move critical controllers off the public internet where possible, replace every default username and password, apply firmware updates on schedule, and segment operational technology networks from general office and guest traffic. A written offline-operations plan is also a safeguard.<\/p>\n