Cyberattack on French Supermarkets Causes Major Stock Losses
Overnight from Sunday to Monday, a significant cyberattack struck the refrigeration systems of numerous French supermarkets, as reported by BFMTV. The attackers specifically targeted equipment from the Danish manufacturer Danfoss, which is widely used in French stores to manage cold storage. This malicious act led to the destruction of fresh and frozen inventory, and authorities noted that there were also incidents of fires.
The method employed by the hackers was both simple and destructive. They activated the forced defrost function of the refrigeration systems remotely, setting the temperature to a damaging 50 degrees. As a result, the equipment heated for several hours instead of maintaining the necessary cold temperatures. When staff arrived at the stores the following morning, they were met with a wave of heat emanating from the fridges and freezers.
According to reports, approximately 300 Intermarché and Netto stores, along with fewer than 100 U stores, were impacted by this cyberattack on October 12. The hackers altered the temperatures of the refrigeration systems, leading to the loss of significant amounts of fresh and frozen products. The Mousquetaires group confirmed that their Intermarché and Netto stores were among those affected, while Coopérative U reported similar issues at its locations. E.Leclerc also acknowledged that several of its stores experienced problems with their cooling equipment, although specific numbers were not provided. Additionally, a specialized news outlet indicated that Carrefour Market and Monoprix stores were also targeted, but these chains have yet to confirm the reports.
The financial ramifications of this attack are substantial. Industry sources estimate that national losses could reach several million euros. Intermarché stated that all affected stores had to dispose of their compromised fresh and frozen products. For instance, an Intermarché in Haguenau reportedly lost its entire frozen stock, valued at around 50,000 euros, while a Leclerc store in Wasselonne had to discard approximately 220,000 euros worth of goods.
The damage extended beyond just a few locations. In the Loire-Atlantique region, the large Leclerc Atlantis in Saint-Herblain removed all frozen products from its Drive service indefinitely, and the Leclerc in Saint-Brevin-les-Pins was not expected to reopen its fresh aisle until October 13. Some U stores were affected as well, with reports indicating that certain locations only experienced issues in their frozen aisles. One image shared by BFMTV depicted an ice cream shelf registering a temperature of 26 degrees, far too warm for proper storage.
CEO Addresses Unprecedented Food Supply Threat
Dominique Schelcher, the CEO of Coopérative U, expressed the seriousness of the situation on social media, emphasizing that targeting equipment essential for preserving fresh food is unprecedented and alarming. He highlighted that this attack was not about data theft; rather, it directly impacted food supply for French consumers.
In response to the attacks, the Paris prosecutor has initiated an independent investigation into the cyberattack affecting connected refrigeration systems across major French food retailers. The inquiry is being led by the anti-cybercrime unit, with the OFAC office tasked with assessing the number of victims and the damages incurred, including spoiled food and fire incidents.
This incident follows a troubling precedent. On August 9, Claroty’s Team82 released research detailing vulnerabilities in Danfoss refrigeration controllers. Their examination of the AK-SM 800A model, which was targeted in this recent attack, uncovered multiple flaws, including a hidden authentication mechanism that bypassed standard login protocols.
Approved for Dissemination
The controllers in question are typically managed remotely and feature built-in web servers. If an attacker gains access, they can send direct commands to the cooling systems, such as forcing a manual defrost. Claroty’s research indicated that these products are widely deployed in supermarkets, cold-storage facilities, and logistics warehouses, with a scan revealing thousands of exposed management interfaces online. Claroty had previously disclosed these vulnerabilities to Danfoss, which subsequently issued patches in firmware version R4.3.1.
However, authorities have not confirmed whether the hackers exploited this specific vulnerability in the recent attack. If they did, it would align with standard security disclosure practices, as details were withheld until a patch was available. For older, end-of-life units, no security patches exist, leaving disconnection from the public internet as the only viable defense.
