The researchers spent months mapping exposed Carel and Danfoss refrigeration controllers across France, finding hundreds reachable via standard HTTP ports with default or no credentials. Their framing emphasizes the duration (months of exposure) and scale (hundreds of controllers across major chains like Carrefour and Intermarché) as evidence of a systemic industry failure rather than isolated misconfiguration.
By surfacing the ipinfo research to HN, the submitter frames this as a notable instance of the recurring industrial control exposure pattern that the security community has been documenting for over a decade. The 82-point score reflects community recognition that this is a structural issue worth attention.
The editorial argues the structural cause is that HVAC and refrigeration integrators are electricians with laptops, not security professionals — their job is making fridges talk to monitoring portals, and security hardening is outside both their scope and skillset. This explains why the same OT-exposure story has repeated since 2013 despite years of security community warnings from Dan Tentler, Dragos, and GreyNoise.
The researchers highlight that Carel and Danfoss ship controllers with HTTP web UIs active by default, demo credentials in place, and firmware dating to 2015 still in production. The implication is that vendors knowingly ship devices in a configuration that only works safely behind a VPN, while providing no friction against direct internet deployment.
Researchers at ipinfo.io spent several months mapping internet-exposed industrial control gear in France and found what anyone who has ever typed `port:80 country:FR product:carel` into Shodan already knew: a large, embarrassing fraction of the country's grocery cold chain is sitting on the open internet with the login page right there. Hundreds of refrigeration controllers from Carel and Danfoss — the two vendors that quietly run most of Europe's supermarket freezers — were reachable without a VPN, many with default credentials or no auth at all.
The units in question are the little black-box PLCs bolted into the back room of every Carrefour, Casino, Intermarché, and corner Franprix. They monitor evaporator temperatures, run defrost schedules, log compressor runtime, and raise alarms when a case gets too warm. They are also, in the shipped-from-factory configuration, HTTP servers with a web UI that was never designed to touch the internet. ipinfo's scan surfaced live dashboards showing aisle-by-aisle freezer temperatures, with buttons an unauthenticated visitor could use to change setpoints, trigger manual defrost, or silence alarms.
The exposure window wasn't a weekend. The researchers watched specific IPs stay reachable for months. Some controllers had firmware from 2015. A nontrivial number were running the vendor's demo credentials. The sites were not hidden behind an obscure port — most were on 80 or 8080, indexed by every passive scanner on the planet, and had been for the entire time ipinfo was looking.
The cheap read is "lol, French supermarkets." The honest read is that this is the exact same OT-exposure story Dan Tentler, Dragos, and GreyNoise have been publishing since 2013, and it keeps happening because the structural causes have not changed. HVAC and refrigeration integrators are not security firms. They are electricians with a laptop. The job is "make the fridge talk to the monitoring portal," the fastest path is "ask the ISP for a static IP and port-forward 80," and the handoff document to the grocery chain's IT team is a Post-it note that got lost in 2019.
What makes refrigeration specifically ugly is the blast radius. A compromised web dashboard is not just an information leak. An attacker with write access to a Carel pCO or a Danfoss AK-SM can raise setpoints across a store's frozen aisle, disable the high-temperature alarm, and walk away — the spoilage shows up on the morning shift, not in the SIEM. For a chain running thin margins on perishables, you don't need ransomware to inflict six figures of damage per store; you need five minutes and the manual. The same controllers also sit on flat networks with the point-of-sale VLAN more often than any auditor would like to admit, which is how the 2013 Target breach started and nobody wants to relearn.
There's also the question of who actually owns the risk. The grocery chain thinks the integrator is responsible. The integrator thinks the vendor shipped it secure. The vendor ships a device with a documented default password and a hardening guide buried on page 94 of a PDF. The ISP sees a customer who asked for a public IP and provides one. No single party in that chain has the incentive, the asset inventory, or the authority to fix it, which is why the same scan would turn up the same results in Germany, Italy, the UK, and almost certainly the US tomorrow. The French angle is a reporting artifact, not a national failure.
And the regulatory story is finally starting to bite. NIS2 came into force last October and explicitly covers food-sector operators of essential services above a size threshold. The Cyber Resilience Act, which lands in enforcement in 2027, will require vendors like Carel and Danfoss to ship devices without default credentials and provide security updates for the declared support lifetime. ipinfo's report is the kind of evidence that regulators cite when they're deciding whether to open an inquiry, and a chain whose fridges show up in a published scan has a much harder time arguing it did due diligence.
If you run infrastructure that touches physical systems — building management, industrial sensors, kiosks, digital signage, parking meters, EV chargers, anything with a web UI and an ethernet port — this is your weekly reminder that the question is not "are any of my devices exposed" but "which ones, and for how long." Run the scan yourself before someone else publishes it. Shodan, Censys, and ZoomEye all offer free tiers that will find your public footprint in under an hour. Filter by your ASN, your known public ranges, and the vendor strings of whatever gear your facilities team installs. If you don't know what your facilities team installs, that's the finding.
The remediation is unglamorous and well-understood: put the controllers behind a VPN or a vendor-provided cloud tunnel, rotate every default credential before the device leaves staging, segment the OT VLAN from everything that touches a card reader, and treat the integrator's "we need port 80 open for remote support" the way you'd treat a request to disable TLS. If a vendor's remote-support model requires an internet-exposed web UI on the device itself, the vendor's remote-support model is the problem — not your firewall policy.
For engineering leaders, the deeper lesson is about asset inventory as a solved problem that nobody solves. The tooling exists: runZero, Armis, Claroty, Nozomi, Dragos, half a dozen others. The reason it doesn't get deployed is not technical, it's that OT asset discovery is somebody else's budget — facilities, not IT — and the person who would benefit (the CISO) doesn't control the spend. The chains in ipinfo's dataset almost certainly have a CMDB. The fridges are not in it.
Expect more of these reports, not fewer. Passive internet-wide scanning has gotten cheap enough that any motivated researcher can produce a Carel-grade embarrassment for a different vertical every quarter — hospital building controls, school district HVAC, municipal water SCADA, EV charger backends — and the regulatory environment is finally starting to make "we didn't know" an insufficient answer. The vendors will quietly ship defaults-off firmware over the next 18 months to stay ahead of CRA. The integrators will keep forwarding port 80 because that's how the job gets quoted. And somewhere in a Carrefour backroom, a pCO controller shipped in 2017 is still answering HTTP requests from Belarus. The useful move today is not to feel smug about French retail — it's to open Shodan, type in your ASN, and find out what you're about to read about yourself.
Through my work I deal with grocery software and I can tell you that grocery software is ages behind the times. For most small retailers (small being a business owner with less than 10 stores in their retail chain, mostly local grocers) you are dealing with processes that would have been considered
No one at Danfoss got alerts than sudently hundred of fridges entered defrost mode? Reminds me of those computer you see at stores running weird ms-dos software.
>85% ran software with known security flaws. That includes 527 older controllers Danfoss no longer supports. Only 195 had every known fix.As long as the fridges are used the controller has to be supported.This isn't a raspberry pi $50 a pop...
fridges are very reliable. but let's IoT them anyways so they can theoretically notify us if there is a problem.so of course that creates/enables the problem and doesn't notify us.deliciously ironic and rottingly sad.this case was egregious - built-in backdoor pw - but that is downstr
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
So the author charitably calls the 2025 vulnerability a "login bypass", but it's much worse than that. The firmware included a "datetime-based password" mechanism: a built-in backdoor password, like it's the 90s again.The original researcher published about this in Augu