Cyber attack hits fridges in French supermarkets
Danfoss said most of the affected units were older products that no longer receive software or security updates.
A large-scale cyber attack on connected refrigerators at several major French supermarket chains caused food losses and fires, Paris prosecutors have said.
Les Mousquetaires, the group that owns Intermarché, said its fridges were heated up to 50C for six hours overnight into 12 October and that it had thrown away all the affected food to avoid health risks.
The group said about 150 of its stores were affected, though other reports put the number of Intermarché and Netto shops hit at 300 or more. The total across all chains has not been confirmed.
Carrefour said 80 of its supermarkets were affected, but that most of its 6,000 stores were not. Monoprix said about 5% of its roughly 490 stores in France were hit.
Dominique Schelcher, chief executive of Coopérative U, said the cooperative had also been targeted. Schelcher wrote on X that targeting such equipment was of extreme gravity and unprecedented.
What is known about the cause
CERT-FR, whose website is published by France’s National Cybersecurity Agency (ANSSI), said on 12 October that it was aware of numerous compromises of Danfoss AK-SM and AK-SC series devices. Exposing a management interface to the internet goes against good practice, it said.
It advised disconnecting or filtering access to AK-SM and AK-SC instances.
For any device suspected of being compromised, CERT-FR listed these steps:
- restricting network access to service providers only
- a factory reset
- applying all available security patches
- rotating secrets
- checking existing accounts
- reconfiguring the device as a whole
Danish manufacturer Danfoss said it was “aware of incidents in France affecting a limited number of refrigeration management systems”. It said the affected units were running “outdated firmware”, and that it had long advised customers to keep supported systems updated with the latest firmware.
Danfoss said its AK-SM800 and AK-SC355 regulators were among the affected equipment, and it gave no figure for how many systems were hit.
Prime Minister Sébastien Lecornu has instructed ANSSI to investigate, and a spokesperson for the prime minister’s office said France was coordinating with European counterparts because other countries could be affected. Reuters reported that ANSSI had identified a vulnerability in software supplied by Danfoss.
The Paris prosecutor’s office has opened an investigation, which it said aims to identify the victims and establish the link with the damage they reported. Authorities have not identified those responsible.
Felix Aime, a senior cyber threat intelligence analyst at the security firm Sekoia, said Spain, Portugal, Poland, Germany and Belgium had also been affected.
The French retail federation, the Fédération du Commerce et de la Distribution, called on Danfoss for “full transparency” and said some stores were already back up and running.
