Unprecedented Meltdown, Practical Solutions
October 12th saw a major meltdown across France as cyberattacks disrupted refrigeration control systems in almost 300 Intermarché and Netto stores. Attackers allegedly switched on the refrigerators’ defrost mode, spoiling huge quantities of fresh and frozen products. The Alsace region alone reported losses totaling €270,000, while across France they could reach several million euros.
The attacks targeted the widely-used Danfoss AK-SM 800A platform. This system gathers information from refrigeration units and offers a web-based management interface for monitoring and configuring the equipment.
Expert analysis
Team82 from the cybersecurity firm Claroty identified vulnerabilities in the AK-SM 800A, including a hidden authentication bypass, command injection enabling remote code execution, and unauthorized Nginx configuration changes that could cause denial of service. Their investigation also found thousands of AK-SM 800A management interfaces publicly exposed on the Internet.
Amir Zaltzman, vulnerability researcher for Team82, had told customers using AK-SM 800A controllers that they should upgrade their firmware as soon as possible. In addition, he recommended: “Organizations should also avoid exposing management interfaces directly to the Internet, and ensure that access to administrative services is restricted to trusted management networks or secured through VPNs and other appropriate network segmentation controls.”
Two Problems – Two Solutions
We see two problems here: software vulnerability, and data exposure.
- Software vulnerability must be solved by the device and firmware provider, and implemented by the customer–in this case, the supermarket chain. Control engineers and integration teams in any food store or chain with refrigeration equipment using AK-SM 800A controllers should upgrade the firmware immediately.
- Data security is a deeper and more far-reaching an issue. Those hackers should never have gained access to that equipment in the first place. Any kind of industrial or commercial equipment that needs to exchange data with the outside world must be isolated.
However, traditional IT approaches — VPNs, remote desktop, perimeter firewalls with inbound rules — are not sufficient. This is an OT network architecture issue. Engineering teams should consider: Which of your OT devices are accessible from external networks? Do any firewall rules allow inbound connections to the plant? If you close every inbound path today, what data access would be lost?
The goal is not to stop data from flowing. It is to ensure nothing unauthorized can enter.
A Structural Approach
The architecture that prevents this class of attack uses outbound-only connections from the OT network, carrying data across a DMZ to IT or cloud systems without opening any inbound ports. DataHub tunnel/mirror technology from Skkynet does exactly this — and has for over two decades. This kind of attack is architecturally impossible when no inbound path to the OT network exists.
Skkynet recommends:
- Outbound-only tunnel/mirror connections that initiate from inside the OT network, with all firewall ports closed inbound, and SSL encryption throughout. Even a compromised receiving side cannot reach back into the system.
- DMZ-based network segmentation with guaranteed data consistency at every hop. This is not MQTT, whose QoS guarantees do not propagate past a single broker. DataHub tunnel/mirroring flags stale or disconnected data immediately at every node in the chain.
The reported cyberattacks on refrigeration control systems is exactly what DataHub tunnel/mirror architecture was built to prevent. The attacks succeeded because the devices were directly accessible with no segmentation, no mediation, and no architectural barriers. An outbound-only, DMZ-compatible architecture eliminates that entire attack surface — and keeps process data flowing where it needs to go.
