Cyberattack knocks out refrigeration at hundreds of French stores

A cyberattack remotely tampered with the refrigeration systems of French supermarkets between Sunday, Oct. 11, and Monday, Oct. 12. No data was stolen, AFP reported, but stores had to throw out fresh food to keep the cold chain intact.

Thierry Cotillard, of the Mousquetaires group, which owns the Intermarché chain, said the attackers put every refrigerated case into defrost mode, a cycle that briefly warms the unit to clear ice, and pushed temperatures up to 50 °C (122 °F). AFP adds that some equipment began to catch fire.

How many stores

The figures come from the chains themselves and vary by source:

• Intermarché and Netto: at least 300 stores, according to AFP. Silicon.fr had counted 150 to 200 in the first tally.
• Coopérative U: under a hundred.
• E.Leclerc: "several stores."
• Carrefour (80 stores) and Monoprix (about 30): AFP mentions them, but Silicon.fr treats them as not officially confirmed.

Cotillard put losses at "tens of millions of euros" nationwide in a single morning of crisis management. That is the company's estimate, and it says its insurance does not cover this type of incident.

What authorities are asking

A source close to the case told AFP that the target was the cold-regulation systems of the Danish manufacturer Danfoss. The company replied that most of the affected units are old and no longer receive security updates.

Vincent Strubel, director of France's national cybersecurity agency ANSSI, called it "urgent" to take Danfoss AK-SM and AK-SC controllers off the internet or, at the least, apply very strict network filtering. The prime minister assigned the case to ANSSI. Paris prosecutors opened an investigation, run by the Office for Combating Cybercrime, to identify the victims and link the attack to the discarded food and the fires.

What is not known

The sources do not say how the attackers got in or who they are, and there is no CVE identifier for this case. No statement from Danfoss itself or document published by ANSSI was found. Silicon.fr notes that Claroty researchers had already published flaws in the AK-SM 800A model and that Danfoss released firmware to fix them, but no source ties those flaws to this attack.

Refrigeration controllers are industrial devices that are often connected to the internet so a technician can manage them without visiting the store. No similar case has been reported in Mexico in what was reviewed. The outcome of the Paris investigation is still pending.