Disposable products, remote defrosting… What we know about the unprecedented cyberattack on supermarket fridges

Hundreds of French supermarkets were victims of a cyberattack targeting their refrigeration installations during the night from Sunday to Monday. Hackers were able to remotely change the temperature of equipment, causing the loss of fresh produce. An investigation was opened by the Paris prosecutor's office. 20 Minutes takes stock of this massive attack.

Which supermarkets were affected?

Several large brands are affected: at least 300 Intermarché and Netto stores, 80 Carrefour, around thirty Monoprix, less than a hundred Coopérative U points of sale and several E.Leclerc stores. The final assessment remains to be established.

The pirates managed to “defrost all our cold furniture and raise the temperature to 50 degrees,” explained Thierry Cotillard, boss of Les Mousquetaires/Intermarché, Monday evening on BFMTV. To respect the cold chain, distributors must throw away affected products. Losses could reach “tens of millions of euros at the national level”, according to the leader.

How did the pirates do it?

According to a source close to the matter, the attack targeted the refrigeration control systems of the Danish manufacturer Danfoss. The company specifies that “the majority of affected units are old products […] which have reached their end of life and no longer benefit from software or security updates”. The manufacturer notably reported a significant flaw on September 18.

The director general of ANSSI, Vincent Strubel, considers it “urgent to disconnect them from the Internet, or to adopt at least a very restrictive network filtering policy”, in reference to the Danfoss AK-SM and AK-SC controllers. According to Antoine Hautin, from the cybersecurity firm Almond, these industrial equipment, long isolated from the internet, are now accessible remotely without having always been designed to resist cyberattacks.

An open investigation, what consequences?

The Paris public prosecutor's office opened an investigation on Monday, October 12, entrusted to the Anti-Cybercrime Office (OFAC). Investigations must identify victims and assess the damage, including food loss and incidents involving equipment that started to catch fire. ANSSI is mobilized in France and at the European level. Prime Minister Sébastien Lecornu is personally following the matter, according to his entourage.

All our articles on cyberattacks