The cyber attack on French supermarkets affected more stores than initially expected. Around 700 of the country's 10,000 supermarkets were affected, Finance Minister Roland Lescure said in parliament. Initial estimates were around 500.
The attack "does not pose a risk to France's food supply" but strikes "at the heart of our food security," said the minister. “It was a wake-up call to everyone.” According to him, the stores have taken the affected systems offline and are restocking their shelves.
Ahold Delhaize: Disruptions also in the Netherlands
At the same time, the Dutch supermarket group Ahold Delhaize reported disruptions. Ahold Delhaize said the company had temporarily taken cooling systems offline after a safety problem. There is no evidence of data theft. The group includes Albert Heijn in the Netherlands, Delhaize in Belgium and the US chains Stop & Shop and Giant Food.
The incident began on Sunday evening and also affected online services. The websites of the branches in the Netherlands and the USA were still offline on Wednesday morning and orders and deliveries were not possible.
In the meantime, Ahold says it is restarting certain systems in a controlled manner. The Dutch National Center for Cybersecurity (NCSC) said there was no reason to believe that the incident in the Netherlands was related to similar incidents in other countries.
Refrigerators heated to 50 degrees overnight
In France, the attackers took control of networked cooling systems in the branches on the night from Sunday to Monday. The Paris public prosecutor's office said the devices were heated to 50 degrees Celsius for hours. Their cybercrime unit investigates and assesses damage from spoiled food and possible fires.
The attacks continued on Monday and Tuesday, Le Monde reported. The target was cooling systems from the Dixell brand from the US manufacturer Copeland. In a store in the Bordeaux region, the attackers changed the target temperature of the freezers from minus 22 to plus 150 degrees. At least 300 Intermarché and Netto branches, 80 Carrefour supermarkets, around 30 Monoprix branches and “several branches” of E.Leclerc are affected, as the chains confirmed to broadcaster BFM Business.
According to CEO Dominique Schelcher, 80 of the 2,000 branches at Coopérative U are affected. Most stores could have prevented refrigeration disruptions, but some would have had to throw away food, Schelcher wrote at “It is unprecedented, extremely serious and unacceptable.”
More attacks likely
According to an insider, Prime Minister Sébastien Lecornu commissioned the French cybersecurity agency ANNSI to investigate, the Tagesschau reported. She is coordinating with European partners as other countries could also be affected. In a safety warning, the authority names devices from the Danish refrigeration technology manufacturer Danfoss. Two more types of Copeland devices were added on Tuesday.
“It is likely that attack campaigns targeting these devices are still ongoing,” the agency warned. Coopérative U confirmed to the AFP news agency that it was using equipment from the US manufacturer. Carrefour says it doesn't use any. Danfoss said many of the affected devices had reached the end of their lifespan and were no longer receiving software or security updates. Customers have long been advised to switch to newer systems.
The vulnerabilities in older Danfoss versions have been known for months: On August 9th, the security company Claroty described gaps in the AK-SM 800A control unit that allowed attackers to bypass login and execute code. They are now closed. Copeland, who owns the Dixell brand, acknowledged the vulnerability. “We are currently working with affected customers to mitigate the risk,” the company said and announced that it would strengthen cybersecurity.
Nobody claims responsibility for the attack
It is unclear who is behind the attack. Neither so-called hacktivists nor criminals have claimed responsibility for the crime or demanded a ransom. As the Reuters news agency reported, citing a person familiar with the investigation, this is puzzling French investigators. Such groups usually try to make quick money from their attacks or claim them for political reasons.
Three cyber experts told Reuters the attack appeared to be easy to carry out. “It’s about basic cyber hygiene,” said Ken Munro of British security firm Pen Test Partners. Because of the known vulnerabilities, the attackers would have had an easy time of it; they could also have been “children playing around”. "If this was a state, then why does it only affect some of the French refrigerators? There are many other countries with refrigerators on the internet."
Thousands of controllers can still be accessed from the Internet
On Wednesday, WELT found at least 4,700 Danfoss user interfaces that were visible on the Internet using the Shodan search service. How many of them use vulnerable software is unclear. According to the French company Onyphe, which scans the Internet for accessible devices, only a small minority are running the latest software version.
The German Federal Office for Information Security (BSI) warns against imitators. “This attack could have affected any country and can now find imitators at any time,” said BSI President Claudia Plattner. The Bonn authority advises preventing direct access to control systems from the Internet, using so-called virtual private networks (VPN) and access with multiple login factors and installing security updates at short notice.
