Security Firm Warns On Refrigeration Asset Security

TL;DR

Before you orderOffer from Amazon

Get backup power and energy gear delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Cybersecurity firm Claroty has warned food retailers not to assume refrigeration controllers are isolated from the internet or secure. Its researchers previously identified 2,765 internet-exposed Danfoss AK-SM800A devices, but the number still vulnerable is unknown; Danfoss says affected systems included some running outdated firmware.

Cybersecurity firm Claroty has warned food retailers to check whether refrigeration controllers are exposed to the internet, after attackers reportedly accessed refrigeration systems at supermarkets in France. The company says weak credentials, unsafe configurations and flaws in older communications protocols can put operational equipment at risk; the extent of any continuing exposure is not known.

Claroty said publicly available internet-scanning services, including Censys and Shodan, can identify operational technology devices that are reachable online. That visibility could give attackers a list of potential targets, the company said. Internet access to a controller may also create a route into other operational or corporate systems if networks are not properly separated.

Claroty’s Team82 research group said an earlier scan found 2,765 exposed Danfoss AK-SM800A devices. The firm said it does not know how many of those devices have since received updated firmware or remain exposed to the vulnerabilities its researchers identified. The figure is a count from that research, not a confirmed count of systems currently vulnerable.

In August, Team82 disclosed vulnerabilities in controllers from Danfoss and Copeland that could allow an attacker to manipulate physical temperature systems. Both manufacturers released patches, according to the report. Danfoss has since said that some affected AK-SM800A systems involved in the French incident were running outdated firmware. The company has advised customers to update supported equipment and move away from legacy systems to current-generation products.

How Controller Access Can Affect Stores

Refrigeration controllers manage equipment that keeps food and other temperature-sensitive goods within required conditions. If an attacker can alter temperature settings or trigger defrosting, retailers may face spoiled stock and disruption while systems are checked and restored. The French attacks were reported to have affected refrigeration systems at hundreds of supermarkets, but the source report does not independently establish the full scale or consequences.

The risk is not limited to the refrigeration equipment itself. Internet-facing operational assets can potentially provide a pathway deeper into business networks, Claroty warns. That makes device inventory, restricted administrative access and network segmentation relevant to both physical operations and broader cybersecurity. Supermarkets, cold-storage businesses and other organisations reliant on refrigeration may need to assess systems that were assumed to be isolated.

From Disclosed Flaws to French Attacks

The warning follows reports of a cyberattack on French supermarkets on Sunday night, October 11. Danfoss said on October 12 that it was in close contact with supermarket customers affected by the attack. The report says attackers were reported to have taken control of refrigeration systems at hundreds of stores and changed temperature settings, including by defrosting produce.

Claroty’s August research concerned vulnerabilities in specific Danfoss and Copeland controllers; the report says both companies issued patches. The French incident has renewed attention to whether systems are updated and how they are connected. The available information does not establish that the previously disclosed vulnerabilities were the method used in the French attacks.

““Organisations that choose to make these assets accessible online must not only lock down credentials, but have complete visibility into these assets, the pathways they provide internally to other systems, and also properly segment them in order to limit the blast radius of a compromised system.””

— Claroty

Exposure and Attack Methods Remain Unknown

The number of the 2,765 devices still exposed is unknown, as is how many have installed patches. The source report also does not identify the full set of affected supermarket systems or establish how attackers gained access. Danfoss’s reference to outdated firmware on some affected systems does not by itself confirm that an unpatched vulnerability caused the incident.

Claroty warned that vulnerabilities in other refrigeration systems are also being uncovered, but the report provides no details or count. It is not clear whether the French attacks affected networks beyond refrigeration controls, or what losses or operational impacts the stores experienced.

Retailers Urged to Check Controls

Claroty recommends that supermarkets, cold-storage facilities and other organisations dependent on refrigeration inventory their controllers, determine whether devices are directly reachable from the internet, and restrict administrative services to trusted network segments. Where remote access is required, it advises using a VPN or an industrial remote-access solution, alongside strong credentials and network segmentation.

Danfoss has advised customers to apply current firmware to supported systems and consider replacing legacy equipment. The report does not announce a new patch or a deadline. The next indicators will be whether affected operators update or isolate exposed devices, and whether investigators or manufacturers provide further information about the French attack’s scope and entry method.

Key Questions

What warning did Claroty issue?

Claroty warned that refrigeration controllers should not be assumed to be isolated or secure. It urged operators to check internet exposure, credentials, firmware and network connections.

How many Danfoss devices did researchers find exposed?

Claroty’s Team82 said an earlier scan found 2,765 Danfoss AK-SM800A devices exposed online. The company said it does not know how many remain exposed or have updated firmware.

Did outdated firmware cause the French supermarket attack?

Danfoss said some affected AK-SM800A systems were running outdated firmware. The report does not confirm that this was how attackers gained access or that a previously disclosed vulnerability was used.

What should refrigeration-system operators do?

Claroty advises operators to inventory devices, check whether they are internet-facing, restrict administrative access and segment networks. Danfoss recommends updating supported systems and migrating legacy equipment to current-generation solutions.

Source: rss