Coordinated Hack Forces French Supermarket Fridges to 50C, Sparking Fires and Millions in Food Losses

Key points

• Hackers remotely triggered forced defrosting in refrigeration units across major French retail chains, including E. Leclerc, Intermarché, and Cooperative U.
• At least 300 Intermarché/Netto stores and over 100 Cooperative U outlets were affected, with Carrefour reporting 80 impacted locations.
• The attack targeted legacy software from Danish manufacturer Danfoss, specifically the AK-SM800 and AK-SC355 controller systems, which lacked recent security updates.
• Paris prosecutors opened an investigation into the 'large-scale cyberattack,' which also resulted in fire outbreaks at several stores.
• EU Food Commissioner Christophe Hansen condemned the incident, stating that the 'weaponization of food' has become a reality and requires greater attention to food security.

Background

This incident follows a pattern of increasing concern over hybrid attacks on critical infrastructure in Europe. President Emmanuel Macron recently ordered measures to protect French critical infrastructure from Russian hybrid attacks. The vulnerability exploited in this attack highlights the risks associated with industrial equipment that was previously isolated but is now connected to the internet for remote monitoring and management.

How outlets are covering it

While all sources agree on the scale and impact of the attack, they differ in their emphasis. CBS News and BBC focus on the immediate consequences, including food waste, fires, and the financial losses, with BBC noting specific losses of €270,000 in the Alsace region. CNET emphasizes the technical aspect, highlighting the vulnerability of legacy software and the broader risks to operational technology and the 'internet of things.' All sources agree that the attack targeted Danfoss systems, but CNET provides more detail on the specific firmware issues and Danfoss's response to mitigate the vulnerability.

Why it matters

This attack demonstrates the growing threat to critical infrastructure, particularly in the food supply chain. The exploitation of legacy software in industrial equipment shows how cyberattacks can have real-world, physical consequences, including fires and food spoilage. It highlights the need for better security measures in connected devices and the potential for such attacks to disrupt essential services and food security.

What to watch

Paris prosecutors are investigating the attack to identify the perpetrators and the extent of the damage. Danfoss is working with affected customers to implement mitigation measures, including firmware updates and stronger network protections. French cybersecurity agencies are liaising with European counterparts to identify other potentially affected companies and prevent the spread of the attack.