France: BSI warns of security gaps after defrosting attack on freezers

The cyber attack on French supermarket chains with the widespread failure of cooling systems also alarmed the German Federal Office for Information Security (BSI). “The incidents in France clearly show how cyber attacks can influence and disrupt our everyday lives,” explained head of the authority Claudia Plattner. "This attack could have affected any country and can now find imitators at any time," she warned.

According to government information, 700 supermarkets from different chains were affected by the attack in France at the weekend. The previously unknown attackers had access to the control system of the cooling systems via security gaps and activated a defrosting function there.

On Monday night, the devices were said to have heated up to up to 50 degrees, which also caused some fire alarms to go off. In many cases, the goods in the affected refrigerated departments now have to be disposed of because they are no longer suitable for consumption. However, there are no acute food shortages. Finance Minister Roland Lescure spoke of a “wake-up call for everyone.”

Back door for maintenance technicians

According to previous information, the cause was security gaps in the cooling systems of the Danish manufacturer Danfoss and the US company Copeland. This included, among other things, a back door that supermarkets could use to give external technicians temporary access to the systems. However, security researchers were able to easily crack the necessary password.

Danfoss did publish an update after the gaps were published. However, this does not seem to have reached many supermarkets. According to security researchers, many affected systems were still easily accessible from the Internet. “Danfoss has long been advising its customers to always keep the supported systems up to date with the latest firmware and to operate them behind a firewall,” the company said when asked. Copeland pointed out that the affected systems were outdated.

According to the Federal Association of the German Food Retailers, there are no known attacks on German retailers so far. Nevertheless, the BSI expressly recommends that “control systems accessible from the Internet be secured according to the state of the art,” explained the Bonn authority. “The security measures are obvious and easy to implement,” she added.

Specifically, the BSI recommends preventing direct access to control systems from the Internet; access should only be possible after multi-factor authentication. In addition, operators would have to install security updates and error corrections at short notice.

Meanwhile, the Dutch retail group Ahold Delhaize is struggling with an IT attack that does not appear to be related to the French incidents. The Dutch chain Albert Heijn, the Belgian Delhaize supermarkets and several brands in the USA are affected. Although customers can still shop in supermarket branches, many services such as discount systems or the display of current special offers are currently paralyzed.