Published on
French investigators are searching for the hackers who took over refrigeration units at at least 350 supermarkets, forcing staff to throw away spoiled meat and frozen food.
Stores belonging to Carrefour, Monoprix, Intermarché and Coopérative U were among those hit when attackers manually overrode fridge temperatures. The affected stores are a small fraction of France’s supermarkets.
The lack of a ransom demand or claim of responsibility has puzzled investigators, according to a source with knowledge of the probe cited by Reuters. Criminal and hacktivist groups usually move quickly to profit from or publicise their attacks.
France’s cybersecurity agency said the breach affected fridges running software from Danish firm Danfoss, as well as Copeland and Dixell systems.
Reuters reported it found at least 4,500 Danfoss interfaces visible online on Tuesday, and scanning firm Onyphe said outdated versions were "still widely represented among publicly accessible interfaces".
Danfoss said many affected units had "reached end of life and no longer receive software or security updates" or were "running outdated firmware". Serious flaws in older versions of its firmware were detailed in August by security firm Claroty and have since been patched.
Copeland, which owns Dixell, acknowledged the "vulnerability", saying: "We are currently working with impacted customers to mitigate the risk."
"This is about basic cyber hygiene," Ken Munro, a partner at British firm Pen Test Partners, told Reuters. "Get it wrong and you get a smelly mess of defrosted food."
He said the attack could be "kids messing around". "If this was a nation state, why affect only a subset of French fridges? There are plenty of other nations with fridges on the internet," he said.
Dutch disruption
In the Netherlands, Ahold Delhaize, which owns Albert Heijn, said it had begun a controlled restart of systems after a cybersecurity incident that started on Sunday. The Dutch cybersecurity watchdog NCSC said it saw no link to the French attack.
Dutch broadcaster NOS reported that Albert Heijn had identified servers in the US, Poland, Moldova and Turkey used in the attack. NOS stressed this reveals nothing about where the hackers are, as traffic is easily routed through other countries.
Security specialist Pim Takkenberg told NOS the servers were probably used to scout the systems or try to steal data.
NOS also reported that the incident exposed how thin food stocks are. Shops and distribution centres hold around six days’ supply between them, replenished continuously by just-in-time IT systems that can fail and depend on the power grid.
A report by Clingendael and Erasmus University last month advised households to keep eight days of emergency food rather than three. It found that severe weather combined with a major power and IT outage could take two weeks to recover from.