Your Walk-In Cooler Can Read 36 Degrees While Your Food Spoils

Attackers warmed the refrigerated cases in nearly 500 French supermarkets in a single night, and the screen and alarm on your walk-in answer to the same kind of controller they took over. The fix is a $209 thermometer the attacker can't reach.

The produce manager at a family-owned grocery in eastern Kansas unlocks the back door at 5:40 every morning. Before the floor lights come on, she walks the cases.

The dairy case read 37. The meat case read 34. The walk-in cooler read 36, the number it had shown almost every morning for the eleven years she had worked there.

She pulled a gallon of milk forward to face the shelf. The jug was sweating, and it was warm in her hand.

Inside the walk-in, the air felt like the stockroom. The ground beef was soft, the chicken was soft, and the bagged salad had gone limp on the pallet.

The screen by the door still said 36.

The owner gets a text whenever the walk-in climbs past 41. His phone had been quiet all night.

Nothing in the cooler had broken. Sometime after midnight, someone had told it to stop cooling and to keep showing 36.

What just happened

One night last weekend, attackers reached the refrigeration controllers in hundreds of French supermarkets and forced the cases into a continuous defrost cycle. Intermarché, Coopérative U and E. Leclerc confirmed the attacks to AFP: at least 300 Intermarché or Netto stores, more than 100 Coopérative U stores, and several Leclercs. Carrefour told Reuters that 80 of its supermarkets were hit. Cooling Post puts the total near 500.

Intermarché told its affected stores to "throw away all of the products" that are fresh and frozen. Paris prosecutors opened an investigation and say the attack sparked fires.

The controllers were made by Danfoss, a Danish manufacturer. Danfoss says most of the affected units were legacy hardware that no longer gets security updates: the AK-SM800, declared end of life in 2021, and the AK-SC355, phased out in 2016. Some newer AK-SM800A units were running outdated firmware. E. Leclerc says the attack "affected one of its refrigeration equipment suppliers." Nobody has claimed it, and no ransom demand has surfaced.

A refrigeration controller is a small computer, usually mounted in a back room or on the compressor rack, that runs the cases. It decides when the compressors run, when the fans spin, and when heaters switch on to melt ice off the cooling coils. That last job is the defrost cycle, a short, scheduled warm-up the case is built to ride out. Held on all night, it turns a meat case into a warming cabinet.

If your walk-in has a digital readout on the door, a controller is producing that number.

Why your cooler's alarm didn't help

Rank what you expect to catch a warm cooler overnight, least useful first.

Start with the screen on the case. In August, Claroty's Team82 researchers took apart Copeland's XWEB Pro, a supervisory controller for commercial refrigeration. Copeland equipment sits in about two-thirds of North American grocery stores, according to Armis researchers. Once inside, Claroty could set the displayed temperature to any value from minus 50 to 110 degrees Celsius, whatever the probe actually read. They could also switch the compressor, fans and defrost on or off one at a time. In their demonstration, the display held its reading while the fans stopped and the fridge warmed.

Nobody has said what the French screens showed. Claroty's demonstration means the number on the screen is whatever the controller says it is.

The controller's own alarm has the same weakness. The thresholds that decide how warm is too warm live in the same management interface. Claroty's report on Danfoss's AK-SM 800A found a hidden "code of the day" login that let the researchers skip the password and reach that interface as an administrator. Whoever holds administrator access holds the alarm settings too.

Your refrigeration vendor's monitoring service reads what the controller sends, so it sees what your screen sees.

Your opening staff do catch it. Nobody can fake a warm gallon of milk from a laptop. They catch it at 5:40 a.m., after the stock is gone.

What works is a second thermometer that shares nothing with the controller. It needs its own probe, its own battery and its own cellular connection, and its alert has to go straight to your phone. An attacker who owns the controller has no way to reach it.

What you can actually do this week

1. Put a second thermometer in every cooler that matters. About $209 per unit plus a monthly plan. 30 minutes each. Choose one that sends alerts over its own cellular connection, so it never depends on your store network or your refrigeration vendor's system. The MarCell PRO is one example: $209, then $14.95 a month on an annual plan, with alerts by text, call or email and 24 to 48 hours of battery backup. Set the alarm a few degrees above your normal reading, send alerts to two phones, and test it by leaving the probe on a counter until a phone buzzes.
2. Write a one-page warm-cooler plan. Free. 30 minutes. The first line says that when the second thermometer and the screen disagree, you believe the thermometer. Then list who gets called that morning (your refrigeration contractor and your IT provider) and who decides what gets thrown out. Copy your health department's discard rule onto the page. Oregon's reads: "TCS foods above 41°F, that have been out of temperature for more than four hours, should be discarded." TCS foods are the ones that need refrigeration to stay safe, such as meat, dairy and cut produce. For a vaccine fridge, CDC's instructions say not to discard the doses. Label them do not use, keep them at the right temperature, and call your state or local immunization program or the manufacturer. Photograph everything and save the logs before anything leaves the building.
3. Ask your insurance broker who pays when a hack spoils your stock. Free. One 15-minute call. Ask how a spoiled-stock loss is handled when an attacker caused it, and get the answers in writing. Does the spoilage coverage on our property policy pay when the cause is a cyberattack on the refrigeration controller? Does our cyber policy pay for physical goods, or does it exclude property damage? What records do you need from us to file? The photos and logs from step 2 answer that last question.

The harder truth

The French attack never reached a leak site, because nobody has claimed it and no ransom demand has surfaced. The count I publish every Monday measures extortion, and an attack built to spoil stock doesn't register in it.

My read is that this gets copied. Extortion crews already set their demands by how long a victim can stay down, and a warm walk-in applies that pressure in hours. Small grocers, restaurants, florists and pharmacies have the least slack, because one warm night can mean throwing out a week of product.

The equipment is easy to find. Claroty's Danfoss report included a Censys scan showing 2,765 management interfaces for that one controller model reachable from the open internet.

If your walk-in warmed up tonight and its screen kept reading 36, who would find out before the morning delivery?

If this was useful

I write S6 Ransomware Signal, a free weekly newsletter for small and mid-size businesses without a dedicated security team. Every Monday it turns the week's ransomware activity into plain English and a short list of fixes.

This week's issue also covers AhsayCBS, a backup console many IT providers run for their clients. Huntress saw the first break-in on October 7, and at its last update no fixed version existed. The intruders planted a cryptocurrency miner that pauses whenever someone opens Task Manager. There's the FBI's October 8 arrest of a ransomware negotiator in Pennsylvania, which KrebsOnSecurity's sources tie to the ShinyHunters investigation. And Rhysida posted three US law firms in two days, advertising scanned settlement checks in its listings.

Your cooler's screen answers to its controller. Put one thermometer in there that answers to you.