Hacking of supermarket refrigeration systems: the boss of Coopérative U denounces an “extremely serious” attack

Were the supermarkets targeted by a cyberattack that remotely sabotaged their refrigeration systems guilty of negligence? Coopérative U, Intermarché, Monoprix, Carrefour, E.Leclerc: during the night from Sunday to Monday, in just a few hours, hackers took control of the refrigeration systems and deliberately disrupted the fridges of hundreds of stores across the country, undermining an essential link in the French food supply chain. An attack that is “unprecedented, unexpected and extremely serious,” Dominique Schelcher, CEO of Coopérative U, told RTL this Tuesday morning.

“In my entire professional career, I have never seen this,” noted the manager. Monday morning, employees of several group stores discovered fridges and freezers raised to 35, 50, sometimes 80 degrees, following an intrusion into the centralized cold regulation system. At issue: an obsolete version of the Danish software Danfoss, which still equips a large number of large brands and is said to be directly connected to the Internet, without security by a VPN.

“The investigation will have to say it”

Were the supermarkets negligent? “Our stores are not customers of Danfoss,” retorts the boss of Coopérative U, “but of refrigeration engineers who provide us with these solutions.” Have they informed the stores of potential flaws in their systems? “The investigation will have to say,” says Dominique Schelcher, who refuses for the moment to comment on the origin of the attack. One thing is certain: the “vulnerability” of certain systems will push Coopérative U to “review its processes”.

It is difficult, for the moment, to precisely quantify the amount of damage. According to the CEO, only 80 stores out of the group's approximately 2,000 were affected. “A very large majority of them were able to counter this attack” and thus avoid a “cold break” and the resulting destruction of the products, welcomes Dominique Schelcher. The amounts involved are not insignificant: they range from a few tens of thousands of euros in small stores to “180, even 200,000 euros” in hypermarkets.

The incident, however, is causing concern right up to the top of the state: the Prime Minister's entourage indicated on Monday that Sébastien Lecornu had asked the National Information Systems Security Agency (Anssi), responsible for cyberdefense, to take up the matter. The Paris prosecutor's office, for its part, announced the opening of an investigation, entrusted to the Anti-Cybercrime Office (Ofac), which should make it possible to “identify the victims and [to] establish the link with the damage reported by them”.