According to a report by CNN on October 15th, approximately 700 food retailers were affected by this nationwide cyberattack. Hackers remotely controlled refrigeration equipment, initiating defrost cycles that caused extensive damage to fresh and frozen goods. Supermarket staff faced situations where water accumulated under the freezer cases, along with rotten agricultural products.
French authorities have launched an investigation. French Economy Minister Roland Landsburg said in a speech to parliament on the 13th that this incident is a 'warning for everyone'.
Felix Ame, chief threat researcher at French cybersecurity firm Sekoia, stated that the motive behind the attack "is currently unclear" and cannot rule out the possibility of a single hacker or a hacking group being responsible. He told CNN: "It could also be considered an attempt to disrupt certain economic activities or the stability of critical infrastructure."
Aime added that it seems the perpetrator did not use malicious code in the refrigerator controller, which may make tracking the hacker more complicated.
On the 13th, the Paris prosecutor's office stated in a statement to CNN that it has taken over the case under national jurisdiction, investigating this ‘major cyber attack affecting several major French food retailer networked refrigerators’.
It is understood that the refrigeration and freezer shelves in these grocery stores are controlled by online accessible controllers, allowing the maintenance company to adjust the temperature remotely. According to a statement provided by the French National Security Agency (ANSSI) to CNN, hackers have accessed the controllers operated by at least three companies in France, including the Danish company Danfoss, the US-based Gree Corporation, and Dixell Company.
After a network attack occurred, Denver S acknowledged that many affected devices either "no longer receive software or security updates," or "run outdated software." The company urged customers to "keep supported systems with the latest firmware updates."
According to Marrow, a partner at the British cybersecurity organization Pen Test Partners, this Danish company or refrigerator installer may have accidentally connected the controllers to the public internet, making them accessible to anyone.
Aime said that before the cyber attack, there were over 1,700 affected Danfoss software instances exposed to the internet, providing hackers with a large number of potential targets.
According to security analysis company UK Cyber Defence, the culprits exploited the built-in defrosting function of the equipment and disabled the mechanisms that prevent temperature increases, resulting in the refrigerator thawing overnight. On Monday night, the temperature inside the display cabinets reached up to 50 degrees Celsius within about six hours, and some even caught fire.
Manglo said, “It’s not difficult to figure out how to control these refrigerators.” He added that the equipment management of these retailers is likely “outsourced to a third party, and the third party almost never considers the safety aspects of maintaining these refrigerators.”
Several large French supermarket groups have been attacked, prompting retail executives to warn that the loss could amount to millions of euros.
Moreover, this problem seems not limited to France. Aime told Reuters that Spain, Portugal, Poland, Germany, and Belgium have also been affected by this attack.
Mangro said that consumers don’t need to worry too much. However, he warned that the management system of these refrigerators must be “away from the public internet” and must have verified security measures.
He said, “There is no need for refrigerator controllers to be accessible to the public through the internet. I suggest that corporate boards should ask their suppliers tough questions: Who has outsourced the management of these refrigerators? Who has contractual responsibility for their safety? A single blind spot within a company can lead to the destruction of tons of food.”
