Unidentified intruders alter Danfoss cooling controls across European grocery chains

Key points

• Unknown actors altered refrigeration controller settings remotely.
• Tens of locations within each affected chain were impacted across several European countries.
• Chilled and frozen cases warmed, ruining food and forcing disposal.
• No CVE identifiers were associated with the event.
• The overnight incident before Monday 2 November disrupted store operations.

During the night leading into Monday 2 November, unidentified parties made remote adjustments to Danfoss cooling controllers used by grocery retailers. The changes raised temperatures in refrigerated and frozen display units, creating immediate operational problems for affected outlets. No CVE identifiers have been tied to the event, suggesting the disruption is being treated as an unauthorized operational change rather than a known software vulnerability.

The impact was felt across several European nations, with tens of locations inside each affected retail chain reporting problems. Edible goods were ruined, merchandise was removed from display, and food had to be discarded. Stores also faced broader disruption as staff responded to warming cases and worked through food-safety and stock-removal procedures.

Refrigeration controls are part of the operational technology that keeps food safe and businesses running. Even without malware details or an assigned vulnerability, unauthorized setpoint changes can quickly create waste, loss of consumer confidence and costly store-level interruptions. The fact that adjustments appear to have been made remotely makes access control and network exposure the first areas to examine.

Investigators have not attributed the activity to a known group. Retailers and their technology partners should compare current controller configurations against approved baselines, review accounts with write access to cooling settings, and preserve logs for analysis. Watch for repeated setpoint anomalies, unexplained schedule changes, or similar controller activity at other sites, especially outside normal business hours.

What to do now

1. Immediately audit remote access paths to refrigeration controllers, disable unused connections, and require unique credentials with multi-factor authentication where supported.
2. Rotate passwords and review all accounts that can change setpoints, schedules or operating modes on cooling equipment.
3. Compare every controller's current settings against an approved baseline, restore safe values, and verify case temperatures before restocking.
4. Place refrigeration and HVAC controls on a dedicated network segment with firewall rules that allow only required management traffic.
5. Enable centralized logging for configuration changes and alert on setpoint adjustments made outside business hours or from unexpected sources.
6. Contact Danfoss and the site integrator to review controller configurations, preserve evidence, and identify whether other locations share the same exposure.
7. Brief store managers on manual temperature checks and disposal procedures until all affected controls are confirmed secure and operating normally.

Original source

The Hacker News