Hackers remotely seized control of refrigeration systems in hundreds of French supermarkets and turned the freezers into ovens, spoiling food worth tens of millions of euros in one of the most disruptive cyberattacks on physical infrastructure this year.
On the night of October 11-12, attackers took over refrigeration controllers at an estimated 250 to 700 supermarkets across France. They forced the units into extended defrost cycles, pushing temperatures as high as 50 degrees Celsius. Staff arriving to restock on Monday morning said opening the freezers released a blast of hot air. “They pushed the freezers here up to 62C. Everything had to be thrown away,” said a worker at an Intermarche in Issy-les-Moulineaux, southwest of Paris. One store in Normandy reported freezers at 80C. In some shops, the heat set off fires that triggered the sprinklers.
Chains hit included Intermarche, Cooperative U, Carrefour Market, Monoprix, E.Leclerc, Super U, Netto, and Auchan. Les Mousquetaires, which owns Intermarche and Netto, said about 180 stores were affected and another 100 were urgently disconnected from the internet. Carrefour said 80 of its stores were hit, and Monoprix said 5 percent of its shops were affected. Finance Minister Roland Lescure told parliament the figure was about 700 of the country’s 10,000 supermarkets.
A prosecutor’s investigation, no suspects
The Paris public prosecutor’s office opened an investigation into what it called a “large-scale cyber-attack affecting the refrigerators of several major food retail chains across France.” Prime Minister Sebastien Lecornu ordered the national cybersecurity agency ANSSI to investigate. No individual or group has claimed responsibility, and how the attackers got in has not been made public.
Investigators zeroed in on a vulnerability in software supplied by the Danish company Danfoss. Most of the affected controllers were older AK-SM800 and AK-SC355 models that no longer receive security updates, or newer AK-SM800A units running outdated firmware. French authorities later extended the alert to controllers from Copeland and Dixell. The panels are connected to the internet so maintenance contractors can adjust them remotely, and researchers at Claroty’s Team82 found many of the devices were directly exposed to the public internet.
The cost of the cold chain
Thierry Cotillard, president of Les Mousquetaires, put the national cost at tens of millions of euros, and a legal fight over who is responsible has already begun. France’s computer emergency response team CERT-FR says attacks are probably still going on.
The incident has become a case study in how hyper-connected infrastructure creates new attack surfaces: a company does not have to lose a single file to suffer a devastating attack. When the systems that keep operations running become the weapon, the damage is physical, immediate, and expensive.
