Cyberattack on French Supermarkets Disrupts Cooling Systems and Spoils Food
French investigators are actively searching for the hackers who gained control of cooling units at hundreds of supermarkets in a cyberattack that highlighted the vulnerabilities of connected systems. This incident, which affected major supermarket chains such as Carrefour, Monoprix, Intermarche, and Cooperative U, has not been claimed by any group as of yet.
The cyberattack involved manually overriding the temperatures of refrigeration units, resulting in the disposal of perished meat and frozen goods at several Paris supermarkets. Reports indicate that at least 350 supermarkets were impacted, which is a small fraction of the total number in France.
In response to the attack, Prime Minister Sebastien Lecornu has directed France’s National Cybersecurity Agency (ANSSI) to conduct a thorough investigation. Authorities are also collaborating with European counterparts to assess whether other countries may be at risk from similar vulnerabilities.
Dominique Schelcher, CEO of Cooperative U, reported that 80 of its stores were affected out of a total of 2,000. While he could not provide an exact financial impact, he estimated that losses could reach several tens of thousands of euros for smaller stores and up to €200,000 ($223,480) for larger hypermarkets. Intermarche's CEO, Thierry Cotillard, described the attack as unprecedented, predicting nationwide losses in the tens of millions of euros within a single day.
The incident underscores the importance of resilience across the entire supply chain, according to Christel Delberghe, director general at Eurocommerce, a European retail association. Supermarket refrigeration systems are typically managed by control panels that can be accessed remotely, allowing maintenance companies to adjust settings from anywhere.
Danfoss Software Vulnerabilities Exposed
The affected refrigeration units were reliant on software from the Danish firm Danfoss. On Monday, Danfoss acknowledged that many of the compromised units had reached the end of their operational life and were no longer receiving software or security updates. The company had previously advised customers to keep their systems updated and migrate to current-generation solutions.
Cybersecurity experts have noted that the vulnerabilities present in older versions of Danfoss firmware have been known for months. A report from cybersecurity firm Claroty detailed weaknesses in the Danfoss AK-SM 800A controller that could have allowed intruders to bypass authentication and execute code on compromised devices.
Intelligence Reviewed
While the exact method used by the attackers to compromise the refrigeration units has not been disclosed, experts suggest that the attack was likely facilitated by a lack of software updates and the exposure of device interfaces to the internet. Ken Munro, a partner at Pen Test Partners, emphasized the importance of basic cyber hygiene, stating that the attackers were essentially exploiting well-known vulnerabilities.
Despite the seriousness of the attack, there has been no ransom demand, leading some to speculate that it may not have been orchestrated by a nation-state. Munro pointed out that if this were the case, the attackers would likely have targeted a broader range of systems. As of now, at least 4,500 Danfoss interfaces remain accessible via the internet, with many still running outdated software versions, according to French internet scanning company Onyphe.
