Cyber-Attack Strikes French Supermarkets, Targeting Refrigeration Systems
A significant cyber-attack has recently targeted several supermarket chains throughout France, focusing specifically on the refrigeration systems essential for maintaining food safety. This incident has left many stores struggling to manage their perishable inventory as the attack impacts operations nationwide.
Retail giants affected by the breach include Coopérative U, which encompasses various supermarket brands such as Hyper U, Super U, U Express, and Utile. Additionally, Groupement Mousquetaire’s Intermarché and Carrefour have also reported being victims of the cyber intrusion.
On October 12, Dominique Schelcher, the CEO of Cooperative U, publicly confirmed on X (formerly Twitter) that the cyber-attack began impacting stores within their network on October 11. In light of this grave situation, he stated, “Our teams are fully mobilized, in coordination with refrigeration specialists, to restore the situation as quickly as possible. An investigation will be needed to shed full light on this attack.”
Schelcher emphasized the critical role that refrigeration systems play in safeguarding food products, highlighting their importance for the public. The CEO described the attack as “of utmost gravity, unprecedented [and] unacceptable," showcasing the seriousness with which the companies view this incident.
In discussions with Infosecurity, a spokesperson for Intermarché revealed that approximately 150 of its stores had been affected by the attack, estimating financial losses to amount to "at least thousands of euros." A representative from Carrefour noted that around 80 out of their 6,000 stores had been impacted. Groupe Casino also reported that 5% of Monoprix supermarkets faced disruptions due to the cyber-attack.
Investigating the Security Breach
Initial reports from French news outlet BFMTV indicated that the cyber-attack involved systems managed by Danfoss, a Danish provider of refrigeration systems. Further, a spokesperson for Intermarché confirmed these claims to Infosecurity. The attackers are believed to have exploited outdated versions of Danfoss’s freezing and refrigeration control software.
Affected stores had been using vulnerable Danfoss consoles that lacked a securely encrypted communication channel. According to BFMTV, hackers allegedly gained the ability to remotely trigger forced defrost cycles, elevating internal temperatures to as high as 50 °C (122 °F). This reckless manipulation of cooling systems could lead to disastrous consequences for food safety, creating significant financial repercussions for the supermarkets involved.
In one alarming case, an Intermarché and a Super U supermarket in Haguenau, located in the Alsace region near the German border, reported combined losses of around €270,000 (approximately $302,000) worth of merchandise due to spoilage caused by the temperature increase. Although Intermarché stated that assessing the total food waste resulting from this attack was challenging, the potential for extensive financial loss looms large.
Legal and insurance teams from affected stores are already scrutinizing the incident, hoping to understand its full repercussions. Other supermarket chains, such as E. Leclerc and Monoprix, were also reportedly included in the list of affected networks, according to Jonathan Le Borgne, a contributor to a specialized retail news website. While E. Leclerc acknowledged receipt of Infosecurity’s inquiry, they have yet to provide a comment on the incident.
Expanding Impact Beyond Borders
The repercussions of the cyber-attack may extend beyond France. Reports suggested that supermarkets in neighboring countries, such as Belgium and the Netherlands, were also affected by similar disruptions. This broad impact showcases the potential for cybersecurity threats to transcend national borders, particularly in a heavily interconnected global market.
Research Uncovers Vulnerabilities
The vulnerabilities in Danfoss refrigeration controllers were underscored by recent research conducted by Claroty. The models involved in the attacks were either outdated or had not received critical security updates. Claroty’s findings also revealed severe cybersecurity vulnerabilities that have rendered some Danfoss products susceptible to unauthorized access. Notably, during a Shodan scan, over 3,700 of these refrigeration controllers were found to be exposed to public Internet access as of August 19.
These vulnerabilities highlight the risks inherent in exposing industrial refrigeration systems online without adequate security measures. The findings from Claroty’s Team82 reveal how attackers can disable cooling systems entirely while manipulating temperature readings, a scenario that could have catastrophic implications for the cold chain.
In light of these events, Danfoss is set to participate in the Chillventa trade fair in Nuremberg, a three-day event dedicated to refrigeration technology, where they plan to introduce new products featuring integrated cybersecurity features.
As the investigation continues, stakeholders from Coopérative U, Monoprix, Albert Heijn, and Danfoss have been contacted for comments but have yet to respond. The story is evolving, and implications for food safety and cybersecurity regulations may unfold as the public and industry watch closely.
Conclusion
This alarming incident serves as a stark reminder of the vulnerabilities embedded in critical infrastructure such as refrigeration systems. As supermarkets work to recover, the focus will likely shift toward enhancing security measures to prevent similar attacks in the future, ensuring food safety remains uncompromised.