Hackers, in a widespread cyberattack, targeted the control systems of refrigerators and freezers in hundreds of supermarkets across France and raised the temperature of these units to 50 degrees Celsius; an incident that caused fires in some stores and spoilage of large quantities of food.
According to ITNA, the Paris prosecutor's office said investigations have begun into this "large-scale" attack that involved internet-connected refrigeration systems of several major food retail chains.
Details of the attack
According to the French television network BFM-TV, which was the first media outlet to publish the news, the attackers managed to remotely activate the "forced defrost" cycle in the refrigeration and cold storage systems of a large number of stores. According to Le Monde, in some freezers and cold rooms, the hackers increased the duration of this cycle from one hour to eight hours to delay the activation of alarm warnings.
The retail chain Le Musceter (owner of the Intermarché and Netto brands) said the refrigerators of about 150 of its stores reached 50 degrees Celsius for six hours. Initial reports indicate that at least 300 Intermarché and Netto stores, about 100 Système U cooperative stores, nearly 80 Carrefour stores, several E.Leclerc branches and about 30 Monoprix stores were affected by the attack.
Monoprix, which has nearly 490 stores in France, said five percent of its branches were damaged.
Response of officials and companies
Dominique Schelcher, CEO of the Système U chain, described the attack as very dangerous and unprecedented and said targeting equipment essential for preserving fresh food and ensuring the food security of the French people is of the utmost importance.
According to a source in the office of French Prime Minister Sébastien Lecornu, he has ordered the French National Cybersecurity Agency (ANSSI) to investigate the attack. The report says France is also coordinating with its European counterparts, as other countries may have been affected and officials are assessing the risk to other French companies as well.
Software vulnerability
According to NBC News, the affected refrigerators relied on software from the Danish company Danfoss.
On Monday, Danfoss said that many of the affected units "have reached end of life and no longer receive software or security updates" or "use outdated firmware."
The company said it has "advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions."
Although the exact mechanism by which the attackers penetrated the refrigerators has not been publicly disclosed, cybersecurity experts say all signs point to a fundamental issue stemming both from failure to apply Danfoss updates and from exposing device interfaces to the internet.
Why this attack is dangerous
Supermarket cold room control panels typically manage all of a store's refrigerators and freezers as a single system and are accessible via the internet; a feature that allows maintenance companies to change settings remotely, but the same capability can become a gateway for attackers to infiltrate.
Retail companies have said all spoiled food has been thrown away to reduce health risks. According to Le Musceter, the damage from this attack could reach several million euros.
So far no group or individual has claimed responsibility for the attack and the identities of the perpetrators remain unknown.