A worker restocking products in a refrigerated section of a supermarket two days after the cyberattack on several French supermarkets in Montreuil, France (AP photo)
France's cybersecurity authority has warned that a cyberattack targeting refrigeration systems at supermarkets may still be underway, as stores restock fresh and frozen goods discarded after temperatures inside refrigerators and freezers surged.The agency said on Tuesday night that the attacks were “likely still underway” and urged retailers to reconnect refrigeration systems to the internet only through secure virtual private network (VPN) connections or protected networks.It also advised stores to install firmware updates and change passwords, according to the news agency Associated Press (AP).Attackers remotely took control of refrigeration systems at hundreds of supermarkets and independent stores across France in the early hours of Monday.
Temperatures reportedly reached 50 degrees Celsius for around six hours, forcing retailers to dispose of fresh and frozen products.The Intermarché supermarket chain reported losses of “tens of millions of euros” in a single day.French finance minister Roland Lescure said around 700 of the country's 10,000 supermarkets had been affected, describing the incident as a “wake-up call for everyone”.The attack has also raised concerns about the security of connected refrigeration equipment and the potential impact of cyber incidents on food supply chains.
Older refrigeration systems under scrutiny
France's cybersecurity agency said it was aware of numerous compromises involving remote-control modules used in refrigeration systems manufactured by Danish company Danfoss and US-based Copeland.Danfoss said many of the affected systems were older products that no longer received software or security updates. Copeland said a vulnerability had been identified in “a discontinued, end-of-life generation of controllers” and that it was working with affected customers.A report published in August by US cybersecurity firm Claroty identified vulnerabilities in the Danfoss AK-SM 800A and Copeland XWeb Pro platforms, which are used to manage refrigeration infrastructure in supermarkets, warehouses and other facilities. Claroty said some Danfoss controllers were directly accessible through the public internet, potentially exposing them to attacks. The vulnerabilities identified in the report have since been fixed.Reuters quoted cybersecurity experts as saying the French attack appeared to have exploited weaknesses in older systems and inadequate security practices. The precise method used to gain control of the refrigeration equipment has not been publicly disclosed.Ken Munro, a partner at British cybersecurity firm Pen Test Partners, described the issue as one of basic cyber hygiene.“This is about basic cyber hygiene,” he said. “Get it wrong and you get a smelly mess of defrosted food.”A scan using the internet search service Shodan found at least 4,500 Danfoss interfaces still visible online on Tuesday. It was not independently established how many were running vulnerable software.
Dutch supermarket chain resumes systems after separate incident
Meanwhile, Dutch supermarket chain Albert Heijn was restocking shelves on Wednesday as its parent company, Ahold Delhaize, began restarting systems that had been shut down as a precaution following a separate cybersecurity incident.The incident, which began on Sunday evening, disrupted online services, halted home deliveries and affected some supplies to the retailer's extensive network of stores in the Netherlands.The Dutch National Cybersecurity Centre said several cyber incidents had affected Europe's food sector but saw “no reason at this time to believe that these incidents are linked”.The disruption highlighted the dependence of supermarkets on digital systems and frequent deliveries.
Pieter Zwaan, a senior researcher at the Clingendael Institute, told AP that Dutch supermarkets relied on “just in time” deliveries several times a day to keep shelves stocked.“Without IT and electricity it is impossible to order and deliver product to supermarkets” so frequently, he said.
Investigations underway, no perpetrators identified
Authorities in France and the Netherlands are investigating the incidents. Europol confirmed to AP that it was in contact with authorities in the affected countries but declined to provide further details because the investigation was ongoing.No perpetrators have been publicly identified, and no group has claimed responsibility for the French attack.François Deruty, a former operations director at the French Cybersecurity Agency who now works as chief intelligence officer at cybersecurity company Sekoia, said it remained unclear whether the attack was directed by an organised actor or carried out by an individual.“I still can't determine whether it's being directed by someone or whether it's an individual trying to take advantage of the prevailing chaos to show off their skills or send a message,” Deruty said.He added that the timing was notable, as French politicians were already dealing with several issues and the disruption had a direct impact on everyday life.The French government has said the attack did not threaten the country's overall food supplies, although Lescure acknowledged that it “touches the heart of our food security”.