Hackers Heat Up French Supermarket Fridges
In a move that gives “burning cash” a whole new meaning, hackers hijacked refrigeration systems at hundreds of French supermarkets over the weekend. By triggering forced defrost cycles, they spoiled massive amounts of fresh and frozen food. One store’s cold room reportedly hit a balmy 122°F (50°C), and prosecutors are currently investigating resulting fires.
Attackers reportedly stretched standard one-hour defrost cycles into eight-hour saunas, delaying alarms while inventory melted. It’s a stark reminder that remote maintenance convenience is just a few compromised credentials away from physical sabotage—no ransomware required.
Equipment supplier Danfoss stated that much of the affected hardware was running outdated firmware or was simply too old to receive security updates. Investigators haven’t confirmed the initial entry point or whether previously disclosed flaws were the culprits here.
IT and facilities teams, audit your internet-connected controllers, update supported firmware, ditch the legacy hardware, restrict remote access, and isolate your operational networks. Set up independent temperature alerts so your early warnings don’t rely on the very systems being exploited.
A backup can restore your files. The ice cream is on its own.
Denmark Breach Linked to ‘123456’ Passwords
Denmark’s registry breach affecting about 8.8 million people just went from bad to profoundly embarrassing. Politiken says at least three accounts at IT vendor Pays ApS, including an administrator, used the spectacularly lazy password “123456.” Authorities haven’t confirmed that security masterpiece as the entry point, but it certainly paints a picture.
Names, addresses, and national ID numbers were accessed, including records for deceased people and former residents. Around 14 million automated searches reportedly occurred before an unusually large bill helped expose the intrusion. Yes, the accounting department apparently did the threat hunting.
Security teams, block common passwords, require phishing-resistant MFA where supported, revoke former employees’ access, and limit vendor permissions. Add rate limits and alerts for bulk queries so you don’t have to rely on invoices for intrusion detection.
Affected residents, verify unexpected contact through official channels, and never share MitID details or authentication codes just because a caller knows your ID number.
“123456” belongs in your password policy’s rejection list, not its success stories.
Citrix Patches NetScaler RCE Vulnerability
Citrix patched a NetScaler vulnerability that could enable remote code execution or denial of service.
The flaw affects specific NetScaler ADC and Gateway builds using SAML authentication, although Citrix has reported no known exploitation.
I’d want to identify NetScaler appliances using SAML authentication and prioritize vulnerable ones for patching.
Check SAML configurations, install the appropriate Citrix patches, and test authentication functionality after deployment.
SonicWall Flaw Draws Attacks Within 48 Hours
Researchers detected over 100 attempts to exploit a critical SonicWall SMA1000 flaw within 48 hours of its patch release.
The vulnerability could expose internal services to unauthenticated attackers, although no successful compromises have been reported.
I’d check whether attackers accessed the internal CouchDB service. That could indicate exploitation beyond initial probing.
Update affected SMA1000 appliances and review WorkPlace logs for suspicious requests targeting internal services.
628K Ukrainian Records Stolen by Threat Actors
CyberXero used Anthropic’s Claude Code to automate attacks that stole over 628,000 records from Ukrainian organizations.
The attacker deployed up to 51 AI agents, scanning 4,708 targets and deploying 32 web shells in just 61 seconds.
The speed of these attacks is what stands out to me. AI agents allowed the attacker to exploit familiar vulnerabilities at a scale that could outpace traditional detection and response processes.
Patch vulnerable WordPress plugins, scan for unauthorized web shells, and alert on suspicious bulk data exports.
Cyberattack Spoils Food at French Supermarkets
Threat actors manipulated refrigeration controls at hundreds of French supermarkets, spoiling food and potentially causing fires.
The attack hit major chains, including Intermarché and Netto, showing how OT attacks can cause physical damage.
I’d verify that refrigeration systems have independent temperature alerts to detect tampering before equipment damage or inventory losses occur.
Segment OT networks, restrict vendor access, update outdated firmware, and implement independent alerts for abnormal equipment conditions.
FBI Takes Down Flax Typhoon Attack Domains
The FBI seized seven domains linked to China-backed Flax Typhoon hackers, disrupting tools used for vulnerability scanning and malware delivery.
These tools supported attacks on critical infrastructure and universities worldwide, with confirmed breaches at Taiwanese institutions.
Seizing these domains disrupts the attackers’ operations, but it doesn’t eliminate access they’ve already established.
Review the joint advisory for compromise indicators, unauthorized remote-access tools, and suspicious logins.
Is Your OT Infrastructure Secure?
As industrial systems become more connected, securing operational technology (OT) is critical to preventing costly disruptions and physical safety risks.
How to reduce OT security risks:
- Segment ICS networks from IT networks and restrict remote access with MFA.
- Patch vulnerable OT devices and isolate legacy systems that cannot be updated.
- Monitor for abnormal equipment behavior and test recovery procedures to ensure safe restoration.
Security teams should work with OT operators to validate critical system protections and confirm recovery procedures before an incident disrupts operations.