What happened?
On Monday, October 12th French supermarket groups Intermarché, Netto, Coopérative U, Carrefour, Monoprix and Auchan revealed that they had been victims of a cyberattack.
The attack targeted equipment made by Danish manufacturer Danfoss, which supplies systems used to monitor and control commercial refrigeration units - the hackers reportedly activated the defrost function continuously and at high intensity, causing temperatures to rise dramatically.
Temperatures rose up to 50C - some refrigeration units were damaged, while large quantities of food had to be discarded. Supermarket customers reported seeing empty chiller and freezer cabinets in stores.
At least 300 stores belonging to the Les Mousquetaires group, which operates Intermarché and some Netto supermarkets, were affected. Around 100 Coopérative U stores, 80 Carrefour stores, 30 Monoprix stores and two Auchan supermarkets were also hit.
READ ALSO: French supermarkets suffer refrigerator shutdown after 'unprecedented' cyberattack
How did the hackers get in?
The attackers reportedly used the search engine Shodan to identify Danfoss devices that were accessible over the internet.
Although supermarket refrigeration equipment is not necessarily connected to a store's internal computer network, some units have 3G cards that allow technicians to monitor temperatures and manage settings remotely.
Cybersecurity expert Kevin Tellier of Synacktiv told Le Parisien that the hackers exploited a vulnerability in a central control system used to manage one or more refrigeration units. Once they gained access, they were able to change the settings remotely.
Danfoss said the incident involved older devices that no longer received software or security updates. The company claimed that it had previously advised customers to keep their equipment up to date and upgrade to newer systems.
The control software used by Danfoss is also used worldwide and has known security vulnerabilities dating back to 2023. The Danish manufacturer has classified some of these flaws as critical, including those that could allow attackers to take control of a system, and said that security patches are available.
Similar cyberattacks were reported in Israel last spring, when hackers disrupted the refrigeration systems at a food-processing plant. US military bases in the United States and Germany also reported unusual incidents this summer involving refrigerators whose defrost cycles had suddenly gone into overdrive.
Who is behind the attack?
The Paris prosecutor's cybercrime unit opened an investigation into the attack, but so far no-one has claimed responsibility.
The supermarkets have not reported any ransom demand and there is no evidence of data theft - a similar pattern to that seen in the incidents in Israel and at the US military bases.
Sabotage targeting industrial control systems was identified as one of the main cybersecurity threats by France's National Cybersecurity Agency (ANSSI) in its latest report, published this spring.
READ ALSO: Cyberattacks: Does France have poor cyber-security or is it more targeted by hackers?
How much food was wasted?
The attack resulted in tonnes of food being thrown away, with total losses reaching millions of euros, according to initial estimates. The exact amount of food destroyed, and the final financial cost, had not been established yet.
The chief executive of Cooperative U, Dominique Schelcher, told AFP that "in a smaller store, losses can reach up to tens of thousands of euros while in a bigger store, the number can go up to €180,000 to €200,000".
For example, at an Intermarché in Issy-les-Moulineaux, near Paris, approximately €50,000 worth of food was reportedly discarded. This included all the ice cream and charcuterie (cold meats) affected by the incident.
Some supermarkets are expected to return to normal as early as Tuesday, October 13th. However, the timing depends on how quickly replacement stock could be delivered and whether damaged refrigeration units could be repaired.
Comments