Hundreds of supermarkets in France had their refrigerators and freezers hacked overnight, with temperatures raised to 50 degrees Celsius. This caused some equipment to catch fire, and food became spoiled and unusable.
According to Reuters, the Paris prosecutor's office said on Monday (October 12) that a large-scale cyberattack affected the connected refrigerators of several major French food retailers, resulting in food losses and fire incidents.
Sources revealed that French Prime Minister Sebastien Lecornu has instructed the French National Cybersecurity Agency to investigate this incident. France is coordinating with other European countries, as these countries may also be affected. The government is assessing whether other French companies are at risk.
Network threat intelligence company Sekoia Threat Detection and Research's senior analyst Felix Aime said that Spain, Portugal, Poland, Germany, and Belgium are also affected.
Carrefour stated that 80 of its supermarkets were affected. Monoprix, which has approximately 490 stores, said that about 5% of its stores were affected.
Intermarché supermarket's parent company, Les Mousquetaires Group, said that the refrigerators in its approximately 150 stores have been heated to 50 degrees Celsius for up to six hours at night. A spokesperson for the group said that all affected food has been discarded to eliminate health risks.
Paris resident Geert de Clercq witnessed employees at the Intermarche supermarket in the center of Paris pouring thawed frozen food into large trash bins. The melted ice cream flowed out of the broken packaging boxes and dripped onto the streets.
"The attacks are extremely serious and unprecedented in their impact on the preservation of fresh produce and on the food supply for French citizens, as we are part of a vital infrastructure that must be protected."
Currently, there is no estimate of the total losses for the entire retail industry. However, Thierry Cotillard, CEO of Intermarche, told French TV channel BFM that this “unprecedented” attack is expected to cause losses of “tens of millions of euros” for the country in a single day.
The refrigerated areas in supermarkets are usually managed through control panels, which are responsible for adjusting the refrigerators and freezers across the entire store. These control systems can be accessed remotely over the internet, allowing repair companies to adjust the equipment settings from anywhere.
A person close to Le Corny said that the French National Information Systems Security Agency has discovered security vulnerabilities in the software provided by the Danish company Danfoss.
Danfoss said that the company “is aware of the related events in France, involving a limited number of refrigeration management systems”.
Danfoss pointed out that the affected devices were using outdated firmware. The company added that it has long advised customers to update systems that are still supported to the latest firmware, and to migrate older systems to new-generation solutions.
On August 9th, Team82, a cybersecurity company under Claroty, released a research report detailing the security vulnerabilities in the Danfoss AK-SM 800A controller. The report indicates that the software updates released by Danfoss have resolved these issues. These vulnerabilities could potentially allow attackers to bypass authentication mechanisms and execute code on compromised devices.
This attack is similar to a system failure that occurred at about a dozen military food supplier stores in the United States at the end of August. At that time, refrigerators were affected, resulting in food losses.
The French Retail Industry Association issued a statement demanding that Danfoss provide a ‘comprehensive and transparent explanation’ of the incident. The association said that supermarkets aim to protect consumers and return to normal operations as soon as possible. Currently, some affected stores have resumed operations.
The Dutch retail group Ahold Delhaize, which operates Albert Heijn, the largest supermarket chain in the Netherlands, and has a large presence in the United States, said that due to 'security issues' in its network, it has temporarily shut down several systems as a precautionary measure.
The group announced in its mobile application that due to a “cybersecurity incident,” it is currently unable to deliver groceries.
Online orders account for about 10% of Albert Heijn’s sales. Physical stores continue to operate as usual. The Dutch news agency ANP reported that the number of delivery orders from competitors has increased significantly.
Ahold Delhaize says there is no reason to believe the events that occurred in France are related to its supermarket operations.
Ahold is the fourth-largest food retailer in the United States. The websites of its chain supermarkets, including Stop & Shop, Giant, Hannaford, and Food Lion, all display a message stating that the websites are temporarily unavailable.
It is still unclear whether other businesses of the group have also been affected.
