French Authorities Investigate Cyberattack on Supermarket Cooling Units
French investigators are actively searching for the hackers who took control of cooling units at hundreds of supermarkets in a cyberattack that has exposed vulnerabilities in connected systems. Notably, no group has publicly claimed responsibility for this incident, which has left investigators puzzled. Typically, hacktivists or cybercriminals would seek to monetize their hacks or claim credit for them, but this case has deviated from that norm.
The cyberattack involved manually overriding the temperatures of refrigerators in supermarket chains such as Carrefour, Monoprix, Intermarche, and Cooperative U. Following the attack, staff at some Paris supermarkets were forced to dispose of large quantities of spoiled meat and frozen goods. At least 350 supermarkets were affected, which, while a small fraction of the total in France, underscores the potential scale of the issue.
France's cybersecurity agency has indicated that the breach impacted fridges utilizing software from Danish firm Danfoss, as well as Copeland and Dixell software. Danfoss has acknowledged that many of the affected units had reached the end of their life cycle and were no longer receiving software or security updates, or were operating on outdated firmware. The company has advised customers to update their systems and migrate to current-generation solutions, but declined to provide further comments.
Expert Insights on Firmware Vulnerabilities
A spokesperson for Copeland, which owns Dixell, did not confirm the specifics of the incident but emphasized that protecting customers' operations is their top priority. Cybersecurity experts have noted that the vulnerabilities present in older versions of Danfoss firmware have been known for some time. For instance, a cybersecurity firm, Claroty, reported on August 9 that weaknesses in the Danfoss AK-SM 800A controller could have allowed attackers to bypass authentication and execute code on compromised devices.
Final Assessment
While the exact method used by the attackers to compromise the refrigerators has not been disclosed, cybersecurity experts suggest that the attack was relatively straightforward, facilitated by the failure to implement Danfoss' updates and by exposing device interfaces to the internet. Ken Munro, a partner at the British cybersecurity firm Pen Test Partners, remarked that this situation reflects a lack of basic cyber hygiene, warning that neglecting such practices can lead to significant operational disruptions.
Munro further speculated that if this were a state-sponsored attack, it would likely target a broader range of systems rather than just a subset of French fridges. The absence of a ransom demand indicates a possible lack of understanding of the potential commercial losses faced by the owners of the affected fridges. Furthermore, many fridges remain accessible via the internet, with reports indicating that at least 4,500 Danfoss interfaces are still visible online. While it remains unclear how many of these are running vulnerable software, a French internet scanning company, Onyphe, has noted that outdated and vulnerable versions are still prevalent among publicly accessible interfaces.
