Unpatched and Outdated Refrigeration System Controllers From Danfoss Exploited
In a significant cyberattack, numerous French supermarkets faced disruptions due to compromised refrigeration units, which resulted in extensive food spoilage and even multiple fires. This incident has raised alarms within the retail sector as hundreds of locations across chains like Intermarché and Netto were affected, leading to vast quantities of perishable goods being rendered unusable.
Thierry Cotillard, president of the Mousquetaires Group—the parent organization of the affected chains—described the experience as "hell” during an interview with BFM Business news channel. He detailed how the attackers manipulated the defrost cycles of their refrigerated display units, causing raised temperatures to reach a staggering 50 degrees Celsius, or 122 degrees Fahrenheit. Cotillard stated that around 300 stores were impacted, with projected industry losses potentially soaring into the tens of millions of euros.
The situation drew immediate attention from French authorities. The Paris Prosecutor’s Office confirmed the activation of its cybercrime unit to investigate the breach, with a focus on identifying victims and linking the damages reported, particularly the food losses and fires. As the investigation unfolded, various supermarket chains disclosed their own unfortunate experiences. E.Leclerc confirmed that several of their outlets had been compromised, while the Monoprix chain reported that 5% of its locations had also fallen victim. Groupe Casino, Monoprix’s parent company, indicated that their teams were working diligently to resolve the issues and replenish their stores.
Reports emerging from the French retail outlet Je Bosse en Grande Distribution suggested that the Carrefour Market chain was similarly afflicted, although they had not officially verified this by the time of publication. Industry leaders expressed grave concerns about the attack’s implications. Dominique Schelcher, CEO of Coopérative U, criticized the targeting of systems essential for food preservation as both unprecedented and deeply troubling. He noted that 80 of their stores were impacted, with anticipated costs varying significantly based on store size—ranging from 180,000 to 200,000 euros for larger supermarkets, down to smaller sums for minor outlets.
At the heart of the breach lies equipment from Danfoss, a Danish refrigeration giant. The company revealed that most of the affected devices utilized outdated AK-SM800 and AK-SC355 system controllers, which are no longer maintained for software or security updates. Even though some locations employed the more recent AK-SM800A systems, they were still running outdated firmware.
Experts have informally dubbed these attacks "Defrost Bypass," given the remarkable method by which attackers exploited vulnerabilities in these systems. Claroty, a cybersecurity firm, identified multiple flaws in the embedded web management interface of the AK-SM800A earlier in the year. This prompted Danfoss to issue a firmware update to rectify the vulnerabilities, though the timing of this update is under scrutiny.
The report from Claroty’s Team82 underscored the potential for severe attacks stemming from vulnerabilities linked to undocumented functionalities and unsecured protocols in internet-accessible cyber-physical systems. Notably, a hidden authentication mechanism allowed malicious actors to circumvent standard password protections by exploiting a "code of the day" formula, derived from the device’s internal clock. A chain of vulnerabilities allowed for remote code execution and even denial-of-service types of attacks.
Aamir Preminger, CTO at Claroty, stated that this incident should serve as a wake-up call for any organization managing temperature-sensitive products, warning that while such industrial control systems are often perceived to be on secure, isolated networks, many remain exposed to the public internet, creating an inviting opportunity for cybercriminals.
Although no group has taken responsibility for this cyber onslaught, cybersecurity experts have speculated a connection to Moscow, asserting that this incident aligns with Russian advanced persistent threat (APT) operations. The timing and nature of the attack resonate with historical tactics employed by Russian hacking groups, particularly as France maintains a strong alliance with Ukraine amidst ongoing geopolitical tensions.
Christophe Hansen, the European Commissioner for food and agriculture, noted on social media that "the weaponization of food has become a reality," in light of the supermarket attacks. This assertion reinforces fears that such actions are intended to undercut public confidence in governmental capabilities to safeguard essential food supplies.
This event is not isolated; it mirrors a recent pattern of attack on refrigeration systems in various critical infrastructure sectors. In August, military commissaries in the United States reported simultaneous refrigeration failures, leading to spoiled food at several bases—a situation that prompted investigations by Army and Air Force special agents.
Additionally, a separate but related incident occurred in May at a food production facility, where attackers targeted two refrigeration systems and manipulated their operating parameters, causing severe operational disruptions. The alarming frequency of these attacks underlines a widespread vulnerability within critical infrastructure and industry systems tied to food safety and supply.
As cybersecurity threats escalate, the focus on safeguarding these essential functions has never been more critical. With the potential for AI to assist in finding vulnerabilities, the call for proactive measures is imperative. The incident serves as a stark reminder for industries reliant on such systems to bolster their defenses against increasingly sophisticated cyber threats, evaluating their reliance on outdated technology that poses grave risks.