Cyber-Attacks Disrupt French Supermarkets: A Growing Concern
In the wake of escalating cyber threats, numerous supermarkets across France continue to face significant disruptions in food stock management due to a targeted cyber-attack on refrigeration systems. The incident, which originated on October 11, has raised concerns about a situation that appears to extend beyond the initial targets.
Reports indicate that the attack is not limited to just Danfoss refrigeration controllers, which were the primary focus initially. There are now indications that temperature regulation devices from Dixell Electronics, an Italian brand under the American heating and cooling equipment provider Copeland, have also been compromised. This broader scope complicates the issue, impacting more locations and emphasizing the need for a comprehensive investigation.
Local media outlet France 3 highlighted a worrying incident involving an E. Leclerc supermarket in the Tarn region of southwestern France. This supermarket reported operational dysfunction within its refrigeration systems, even though it utilized Dixell equipment, rather than the Danfoss controllers that initially garnered attention.
Adding to the growing concern, French national newspaper Le Monde reported on an alarming incident at a supermarket located near Bordeaux. In this case, attackers showcased their technical prowess by modifying freezer settings—an extreme adjustment from −22°C to a staggering 150°C. A technician monitoring the systems noted that changes were happening rapidly, with multiple settings being altered every second, indicating an automated approach to the attack.
A security advisory released by the French national Computer Emergency Response Team (CERT-FR) on October 12 listed both the Danfoss AK-SC and AK-SM series devices, along with Dixell xweb and Copeland xweb systems, as affected entities. This advisory is a crucial step in ensuring that stakeholders are aware of the potential vulnerabilities within their infrastructure.
Fears of Deliberate Industrial Sabotage
The implications of such attacks extend beyond mere inconvenience; they raise serious concerns about the potential for deliberate industrial sabotage. Amir Preminger, the Chief Technology Officer (CTO) of Claroty, an industrial security provider, emphasized that refrigeration controllers serve as prime targets, not only for supermarkets but also for various industrial operations, including cold-storage facilities, warehouses, and pharmaceutical producers. Unfortunately, these critical systems often remain overlooked by traditional security teams.
“Our findings indicate that many industrial control systems, like refrigeration devices, are mistakenly believed to be on isolated networks. However, our research reveals that a significant number of these units are directly accessible via the public internet. This connectivity facilitates easier maintenance and remote troubleshooting, but simultaneously poses a higher risk of cyber intrusion,” Preminger explained.
Preminger pointed out that the technical skill required to execute such an attack does not have to be sophisticated. However, he affirmed that the nature of the actions taken suggests a deliberate intent to inflict damage. “The act of manipulating settings to initiate a defrost cycle is not something one can accidentally trigger by entering a wrong parameter. This indicates that the aggressors had a clear sense of purpose,” he remarked.
He drew parallels between this incident and a previous attack that occurred in a food processing facility in Israel in 2025. In that case, an insider manipulated refrigeration controls, showcasing the potential risks associated with both physical and network security.
Moreover, Preminger cautioned that vulnerabilities could extend beyond French borders. He noted the presence of exposed Danfoss devices in countries like Israel and the United States but lamented the lack of visibility regarding their software versions and current vulnerabilities.
To mitigate these risks, he proposed that patching systems alone is insufficient. He advocated for a proactive approach that involves keeping critical devices off the public internet altogether. Recommended measures include employing corporate virtual private networks (VPNs) and access point name (APN) gateways to restrict unauthorized access. Additionally, he urged operators to segment their network systems, maintain accurate inventories of their equipment, and enforce strict access controls. “Securing your devices and segmenting your networks represent the first line of defense,” he advised.
Understanding the Necessity of Internet Connection for Supermarkets
The reasons behind connecting supermarket refrigeration units to the internet are often rooted in regulatory requirements. In Europe, legislation mandates that these devices maintain timestamped temperature monitoring records to bolster food safety measures while also necessitating alarm systems to alert operators of unusual temperature increases. The connection also allows for remote maintenance, ensuring efficient and timely resolutions to potential issues.
“This system is crucial for maintaining the integrity of food products,” emphasized Dominique Schelcher, CEO of Coopérative U, as he discussed the importance of reliable temperature controls on social media.
The unfolding situation serves as a potent reminder of the complex challenges facing the intersection of technology and food safety, urging stakeholders to reevaluate their cybersecurity protocols and ensure robust protection against evolving cyber threats.