Hot mess: France’s melted freezers hack can happen in Canada, too

Overnight on Sunday, somebody (or something) maliciously broke into internet-connected refrigeration controllers and cranked fridges and freezers at stores across France up to as high as 50 C, spoiling millions of euros worth of food. In some stores, the higher temperatures started fires or even melted equipment. More than 500 shops were affected.

The controllers were made by the Danish firm Danfoss. Most were legacy products running outdated firmware, which the company claims it had urged customers to update. France’s cybersecurity agency has since told operators to disconnect them from the internet or restrict access. Good luck.

Hackers heat French supermarket fridges, sparking fires and spoiling food

Canada has had some close calls, too. Last fall, the Canadian Centre for Cyber Security and the RCMP warned that hacktivists had tampered with internet-exposed controls at public and private facilities in Canada. The government’s alert revealed that water pressure had been changed at a treatment plant, tank gauges at an oil and gas company were manipulated, and the temperature and humidity were altered in a grain-drying silo.

We’ve spent decades embedding network connectivity and software controls into everything, and now these hacks raise serious questions about what it means to own or oversee physical things that are now riddled with vulnerabilities. Much of our public infrastructure works only because foreign private firms keep it running: Pearson Airport’s baggage handling runs on Ignition SCADA software from California’s Inductive Automation; many Ontario hospitals run clinical workflows on Epic, a Wisconsin company; and CN manages its rail network with Pittsburgh-based Wabtec software. These dependencies mean that when something goes wrong, we might not have the ability to fix it.

Such arrangements aren’t inherently unsafe. Canadian software can be just as vulnerable to attack. But dependence on external vendors forces us to confront whether we have the practical ability to keep essential systems running when access is disrupted or political interests diverge.

Some argue that fears of foreign digital kill switches are overblown; no magic button can cut Canada off from any one system. But a choke point doesn’t have to be designed as a kill switch to function like one. Control increasingly resides in software. Recall that in July, 2024, a single faulty CrowdStrike update grounded flights and froze hospital systems worldwide. It may have cost U.S. Fortune 500 companies more than US$5-billion.

‘Blue Screen of Death’ caused by faulty CrowdStrike cybersecurity update throws world into chaos

And we don’t know how much software we depend on. In 2023, Statistics Canada valued all of Canada’s digitally delivered services exports at $70.3-billion. That same year, we bought that same amount from the United States alone. And that’s likely an undercount, since the data only capture cross-border transactions. So when a hospital pays Microsoft Canada for Azure or a retailer buys ads from Google Canada, the sale is typically counted as a domestic one.

The more deeply a U.S. firm embeds itself here, the trickier it becomes to notice those dependencies. More recent data from the U.S. Bureau of Economic Analysis estimates that U.S.-linked digital service supply to Canada is about $93-billion a year. That is equivalent to our auto, steel, aluminum, potash, lumber and electricity exports to the U.S. last year combined, and doesn’t include free services.

Granted, not all this spending represents a strategic vulnerability. But it reveals the scale of our growing reliance on foreign-controlled digital systems and how little we understand where choke points lie. We’re fighting a trade war over steel tariffs and dairy quotas while barely measuring our dependence on the digital systems that make the rest of our economy actually work.

Pro-Iran ‘hacktivists’ could target Canadian organizations, cybersecurity experts warn

Depending on software that we don’t control is about to get even more dangerous. Anthropic just warned that small AI models may be months away from being able to copy themselves onto everyday connected devices like “smart” ovens and cheap TV boxes. The French fridge meltdown is a reminder of how many of those devices are already internet-connected, and maybe even unpatched.

Canada’s general approach to critical infrastructure was set out in the 2009 National Strategy for Critical Infrastructure. Consultations on renewing it suggested adding interdependencies and supply chains to the definition. A subsequent 2021-23 action plan committed to renewing the strategy by 2023. We’re still waiting, and the strategy that defines our critical infrastructure predates the iPhone 4.

The National Cyber Security Strategy explicitly recognizes the possibility of attackers manipulating or damaging physical infrastructure. Under the Critical Cyber Systems Protection Act, designated operators must manage cyberrisks. But this treats vendors as a security risk, and is limited to federally regulated sectors. Australia, by contrast, treats food production and distribution as critical infrastructure and requires operators to report who owns and operates key assets.

Our definition of critical infrastructure could use a little software update too.