Cyber-attack in France: hackers overheat supermarket fridges and freezers
Late last Sunday, a cyber-attack on up to 700 French supermarkets remotely changed the temperature settings of fridges and freezers, spoiling food. Paris prosecutors have opened an investigation, but those responsible remain unknown.
Shortly before midnight last Sunday, hackers in France remotely took control of cooling equipment in supermarkets and raised the temperature in fridges, freezers and chiller cabinets. The attack hit up to 700 stores, including outlets of the Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix chains, as well as smaller independent shops. The case matters because it shows how vulnerable everyday internet-connected equipment can be to cyber-sabotage.
What happened
Equipment that normally holds temperatures as low as -27C was pushed above 50C. At one Normandy supermarket, freezers reached 80C. Over four to six hours the food first thawed and then began to cook. In some stores the heat started fires, set off sprinklers and caused water damage. Staff discarded tons of spoiled food; at the Intermarché in Issy-les-Moulineaux, near Paris, workers restocking shelves stayed until almost midnight on Monday.
Dominique Schelcher, president of Coopérative U, said 80 of its 2,000 supermarkets were affected and called the attack unprecedented. The Paris public prosecutor's office has opened an investigation.
How it was possible
The hackers compromised controllers supplied by the Danish company Danfoss. The units are connected to the internet for remote maintenance and fault alerts. Initial findings suggest the attackers disabled alarm systems or extended the defrost programme by several hours. Danfoss said it identified security flaws last year and had long recommended updating or replacing obsolete systems, adding that the affected units ran outdated firmware. ANSSI, France's cyber-attack alert centre, confirmed that supermarkets using controllers from two other companies were also targeted. Researcher Marta Rybczyńska said many units appeared to be using a default password.
Possible culprits and consequences
Gérôme Billois of the cybersecurity firm Wavestone sees two likely scenarios: young hackers or activists showing off their skills, or sabotage by state actors. No individual or group has claimed responsibility, and identifying them could take weeks or months. Intermarché CEO Thierry Cotillard said losses could reach tens of millions of euros, which are unlikely to be covered by insurance.
