The intrusion was carried out through the Danfoss controller that manages all of a store's refrigeration units. These controllers are designed to be managed remotely by maintenance firms, and that remote access path was apparently abused to reach the devices and manipulate their settings. In at least one case, temperatures were pushed as high as 50°C.

Key points:

• The affected equipment is the central Danfoss controller that runs a store's fridges and freezers.
• Access was achieved remotely, likely via the same channels used by maintenance providers.
• Multiple retail chains reported spoiled stock and forced disposal of food.
• The incident affected hundreds of stores and occurred overnight.

Retailers have not publicly detailed the exact access method or whether credentials were compromised, and no specific advisory identifier or CVE has been cited in the reporting. Stores that rely on remotely managed refrigeration controllers should review who has access to those systems, rotate any shared maintenance credentials, and confirm that remote management interfaces are not exposed beyond trusted networks.

If your organization operates Danfoss refrigeration controllers or similar remotely managed equipment, it is worth checking logs for unexpected temperature changes, configuration pushes, or logins from unfamiliar maintenance accounts.

Source: The Hacker News

Does your organization use remotely managed refrigeration or building controllers, and how are you limiting who can reach them?