Attackers compromised thousands of internet-exposed refrigeration controllers across France, cranking temperatures as high as 50°C, spoiling food and sparking fires at nearly 700 supermarkets in the early hours of Monday 12 October. France's national cybersecurity agency ANSSI warned of widespread compromises involving Danfoss refrigeration controllers on the Monday, and a day later added affected systems from Copeland and its Dixell brand. The Register reported that security researchers had warned about exploitable vulnerabilities in the same controllers months — and in one case more than a year — before the attack, and that the devices were reachable directly over the internet, with many reportedly no longer supported by their vendor. The case is the operational-technology exposure argument in its purest form: unsupported building and refrigeration controllers with public management interfaces turn a consumer-facing business into a safety incident, and the fires make the consequence physical rather than merely financial.

• Source article