Cyberattack disrupts refrigeration at hundreds of French supermarkets
Attackers remotely triggered defrost on Danfoss controllers, spoiling food at hundreds of French supermarkets.
A cyberattack overnight Sunday remotely triggered defrost on refrigeration controllers at hundreds of French supermarkets, spoiling fresh food. About 300 Intermarché and Netto stores and fewer than 100 Coopérative U locations were affected, according to BFMTV, and ANSSI said it is supporting victims and coordinating in Europe. Retailers linked the systems to Danish manufacturer Danfoss and older software versions, though Danfoss has not confirmed it was targeted. CISA previously published an advisory on three Danfoss controller flaws, and Claroty found more than 2,700 devices exposed online, but it is unknown whether those vulnerabilities were used.
- Roughly 300 Intermarché and Netto stores plus under 100 Coopérative U stores were hit.
- Attackers remotely forced refrigeration units into defrost, spoiling fresh food.
- ANSSI is mobilized nationally and coordinating with European counterparts.
- Danfoss has not confirmed its controllers were targeted; older software was cited.
- Prior CISA and Claroty findings on Danfoss flaws are not confirmed as the cause.
Full article374 words · extracted from therecord.media · click to collapse
A cyberattack overnight Sunday disrupted refrigerators at hundreds of French supermarkets, according to retailers and French media. Fresh food spoiled at stores run by some of the country’s largest grocery chains after attackers remotely triggered the units’ defrost function. French broadcaster BFMTV reported that about 300 Intermarché and Netto stores and fewer than 100 Coopérative U stores were affected. “I confirm that a cyberattack has been affecting, since last night, the cold production facilities of several stores in our network” said the Coopérative U chief executive Dominique Schelcher. “Our teams are fully mobilized, in coordination with refrigeration specialists, to restore the situation as quickly as possible,” he added. “Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented,” said Schelcher. “It is unacceptable.” France’s national cybersecurity agency, ANSSI, said in an emailed statement that it was “mobilised to handle this incident” both at the national level to support potential victims and at the European level to coordinate with its counterparts. BFMTV reported that the affected systems are refrigeration controllers made by Danish manufacturer Danfoss, and that the attackers targeted older versions of its software. Groupement Mousquetaires, which owns Intermarché and Netto, said the affected systems were managed by Danfoss, Bloomberg reported. The group said it would be up to the supplier to file a criminal complaint. Danfoss has not publicly confirmed that its systems were the target, and a spokesperson did not immediately respond to a request for comment. Security researchers have previously flagged weaknesses in Danfoss refrigeration controllers. Last year, the U.S. Cybersecurity and Infrastructure Security Agency published an advisory regarding three of these vulnerabilities. Researchers at Claroty’s Team82 later showed that a compromised controller could switch off cooling while still reporting normal temperatures to staff. They counted more than 2,700 of the devices exposed to the internet. It is not known whether those flaws were used in Sunday’s attack.
No previous article
No new articles
Alexander Martin
is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79