Danfoss: Outdated fridge software exposed in cross-border cyber assault

Commercial refrigeration units in London, Belgium, and six other European nations heated to 150C this week after hackers exploited flaws in the software controlling the equipment.

The disruption followed two major cyber incidents in the previous week. On October 30, Binance lost $6.3 billion in a record heist attributed to North Korea. On November 1, hackers sent a fake nuclear strike alert to users of Ukraine’s emergency app.

Alex Pearce, who runs a fruit and vegetable wholesale business in London, discovered the issue during his Monday morning rounds. Defrost lights blinked on units 2 and 4, which registered 150C. He disconnected the internet cable from the central box to stop the process. Pearce said the incident could have caused a fire had it occurred on a weekend when the site was unattended.

The attack targeted companies that provide operating systems for commercial refrigeration, including the Danish firm Danfoss. Danfoss stated that most affected equipment was old and no longer received security updates. The company noted it had long recommended customers install updates or replace obsolete software. Hackers accessed these systems through default access passwords published in user manuals.

Richard Horne, head of the UK’s National Cyber Security Centre, described the current situation as the foothills of a new hacking era. He cited flaws in IT systems exposed by artificial intelligence. Horne warned that a huge rise in incident volume is the most serious short-term risk. He noted that AI tools from OpenAI recently helped discover a flaw in the PHP computer language, which temporarily took websites offline as a precaution.

Xavier Bellekens, CEO of Lupovis, said the fridge attacks bore Russian hallmarks. His firm used honeypot traps on similar fridge controllers and observed attackers using internet service providers tolerant of malicious activity, a tactic linked to Russian groups. He cautioned that while they are not certain of the origin, elements point in that direction. Finland, which shares a 1,340km border with Russia, recorded nearly 21,000 cyber incidents last year, up from 13,000 in 2022.

Paul Chichester, director of operations at the NCSC, said the hackers did not need AI to find the fridge flaws because they were already public. The NCSC projects that AI-powered malicious software will be highly likely to target UK power stations, airports, and hospitals by 2028. Ollie Whitehouse, the NCSC’s chief technology officer, stated that internet-connected devices are susceptible to attacks. He advised manufacturers to invest in security and consumers to pay for and update secure products.

The UK government launched the Be Ready campaign last month, urging residents to store three days of food and nine litres of water. Defense Secretary Wes Streeting said the country must prepare for state-sponsored terrorism targeting everyday infrastructure. Pearce confirmed his 2018 Copeland monitoring system requires an update. He said the vulnerability should have been known earlier, but the ramifications for his business were not severe.