CERT-FR (Organization): news timeline & CVEs

Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers

ANSSI says the French supermarket refrigeration attack also hit Copeland and Dixell controllers, affecting about 700 stores.

France’s ANSSI said the cyberattack that disrupted supermarket refrigeration this week also compromised Copeland XWEB and Dixell XWEB controllers, after first warning about Danfoss AK-SM and AK-SC systems. Finance Minister Roland Lescure said about 700 of France’s roughly 10,000 supermarkets were affected, including Carrefour, Coopérative U, E.Leclerc, Intermarché, and Monoprix. At some Intermarché stores refrigeration ran at 50 degrees Celsius for six hours and food was discarded; prosecutors said the attack also caused fires. How access was gained is still unclear and has not been linked to flaws Claroty disclosed this summer. CERT-FR urged operators to take the controllers offline, and investigators have reported neither a claim of responsibility nor a ransom demand.

SecurityWeekupdated Oct 15, 19:23 UTC · 1d agofirst Oct 15, 12:50 UTC · 1d agoExploit / PoC in the wild 19 sources1

Unplug your smart fridges, French supermarkets warned after cyberattack

Hackers disrupted exposed refrigeration controllers at hundreds of French supermarkets, spoiling chilled food stocks.

A cyberattack on internet-exposed refrigeration controllers ruined chilled and frozen food at hundreds of French supermarkets over the weekend. CERT-FR initially identified Danfoss AK-SC and AK-SM systems, then expanded warnings to Dixell and Copeland equipment, including Dixell’s XWEB interface. Groupement Mousquetaires, operator of Intermarché and Netto, removed products from affected displays. CERT-FR urged stores to disconnect public-facing controllers, use VPNs, update firmware, enforce strict security and replace default passwords.

CSO Onlineupdated Oct 15, 19:23 UTC · 1d agofirst Oct 14, 10:37 UTC · 2d agoExploit / PoC in the wild 19 sources

French Supermarket Cyber-Attack Impacts More Refrigeration Controllers

Attackers altered internet-exposed refrigeration controllers at French supermarkets, spoiling cold storage.

A cyber-attack around October 11 disrupted refrigeration at French supermarkets and appears to extend beyond Danfoss equipment. CERT-FR listed Danfoss AK-SC and AK-SM controllers as well as Dixell and Copeland xweb systems as affected. An E. Leclerc store in Tarn reported disruption despite using Dixell equipment, and Le Monde described a Bordeaux-area supermarket where freezer settings were changed from −22°C to 150°C, with several changes per second. Claroty said many refrigeration controllers are exposed to the internet and that initiating defrost required deliberate action.

Infosecurity Magazineupdated Oct 15, 19:23 UTC · 1d agofirst Oct 14, 09:30 UTC · 2d agoExploit / PoC in the wild 19 sources2

Cyberattacks crank French supermarket refrigeration systems up to 50°C

Cyberattacks pushed French supermarket fridges to 50°C, spoiling food across hundreds of stores.

Cyberattacks on supermarket refrigeration controllers in France reportedly raised temperatures to 50°C (122°F), spoiling food at hundreds of stores and in some cases starting fires. Carrefour, Intermarché (about 150 stores), Monoprix (about 5% of 490 stores), and Coopérative U (80 of 2,000) were among those affected. Danfoss said impacted equipment ran outdated firmware. CERT-FR reported numerous compromises of AK-SM and AK-SC controllers and advised isolating them, resetting, patching, and rotating credentials. Claroty had previously found a predictable date-based admin bypass in the AK-SM 800A, but authorities have not confirmed that flaw was used. Coopérative U said it is not a Danfoss customer. Separately, Ahold Delhaize reported an unlinked cybersecurity incident disrupting Dutch grocery digital services and stock.

The Register · Securityupdated Oct 15, 19:23 UTC · 1d agofirst Oct 13, 12:00 UTC · 3d agoExploit / PoC in the wild 19 sources

Hackers heat up supermarket fridges, spoiling food across France

Attackers tampered with Danfoss refrigeration controllers, spoiling food at French supermarket chains.

Attackers tampered with Danfoss commercial refrigeration controllers used by Intermarché, Netto, Coopérative U, Carrefour, E.Leclerc, and Monoprix, forcing stores across France to discard refrigerated and frozen food. Le Monde reported defrost cycles were extended from one to eight hours; some equipment reportedly reached about 50°C, with damaged gear and fires also reported. Danfoss said most affected units were unsupported legacy AK-SM800 and AK-SC355 systems. Les Mousquetaires estimates several million euros in losses, and the Paris prosecutor’s office has opened an investigation. No attacker has been identified, and no link has been established to a separate Ahold Delhaize network incident.

Malwarebytes Labsupdated Oct 15, 19:23 UTC · 1d agofirst Oct 13, 11:17 UTC · 3d agoExploit / PoC in the wild 19 sources

Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers

Attackers remotely heated Danfoss fridge controllers at hundreds of French supermarkets, spoiling stock and causing tens of millions in losses.

On the night of October 11, attackers remotely controlled Danfoss AK-SM and AK-SC refrigeration controllers at French supermarkets, forcing defrost and heating units to as much as 50°C. Intermarché and Netto reported roughly 150 to 300 stores affected, with Carrefour, Coopérative U, Monoprix, and E.Leclerc also hit; Les Mousquetaires estimated losses in the tens of millions of euros. CERT-FR and ANSSI urged operators to disconnect the controllers or tightly filter access. Danfoss said most units were unsupported AK-SM 800 and AK-SC 355 models, plus some outdated AK-SM 800A firmware, and neither a vulnerability nor an attacker has been named.

The Hacker Newsupdated Oct 15, 19:23 UTC · 1d agofirst Oct 13, 08:48 UTC · 3d agoExploit / PoC in the wild 19 sources2

CERT-FR

Timeline6 articles

Appears with