On the night of October 11, attackers remotely manipulated the refrigeration systems of hundreds of French supermarkets, resulting in food wastage. Several retail companies have confirmed the incident, which saw fridges and freezers heated to extreme temperatures. The breach was facilitated through a device by Danfoss, a Danish manufacturer, which allows remote management of refrigeration units.
Extent of the Cyber Breach
The attack targeted the refrigeration controllers in various supermarket chains, including Intermarché, Netto, and Coopérative U. CERT-FR, France’s cybersecurity response team, issued an alert on October 12 regarding the vulnerability of Danfoss’s AK-SM and AK-SC series. They advised retailers to either disconnect these controllers from the internet or implement stringent access filters. The urgency of this directive was echoed by ANSSI, France’s national cybersecurity agency.
While the perpetrators remain unidentified, Danfoss acknowledged that most affected units were outdated models no longer supported by software updates. The company recommended replacing these obsolete systems to prevent future incidents.
Impact on Retail Chains
Retailers reported varying degrees of impact from the cyberattack. Intermarché and Netto disclosed that up to 300 stores were affected, resulting in significant product loss. Coopérative U reported that the majority of their stores maintained the cold chain, minimizing food spoilage. However, Les Mousquetaires, the parent company of Intermarché, estimated losses could reach tens of millions of euros.
Danfoss has not specified the total number of systems compromised but confirmed that some current models running outdated firmware were also targeted. The company’s statements emphasized the importance of keeping firmware updated to mitigate similar risks.
Recommended Security Measures
CERT-FR’s recommendations for mitigating such attacks include disconnecting and filtering access to vulnerable controllers. For remote management, access should be restricted to trusted IPs only. Danfoss has advised customers to upgrade to newer models and apply all available security patches.
The lack of direct internet exposure and the use of strong passwords are also emphasized in Danfoss’s security guidelines. The company is actively working with clients to enhance network protection and ensure firmware is current.
Ongoing Investigations and Broader Implications
The Paris prosecutor’s office has initiated an investigation to determine the full extent of the attack and its repercussions. ANSSI is collaborating with cybersecurity agencies across Europe, as similar incidents have been reported in other countries, including Spain and Germany.
Security experts highlight the need for robust cybersecurity measures in the retail sector to prevent such vulnerabilities from being exploited. The attack underscores the critical importance of maintaining up-to-date defense mechanisms in an increasingly connected world.
