Hackers exploit firmware flaw to heat supermarket fridges

Hackers forced the temperature of fridges and freezers in many French supermarket ⁠fridges up ⁠to 50 degrees Celsius, causing fires and spoiling food at several hundred stores in a major cyberattack.

The Paris prosecutor's office said a "large-scale" attack was "affecting connected refrigerators in several major food retailers across France", leading to food losses and fires.

Prime Minister Sebastien Lecornu has instructed France's National Cybersecurity Agency (ANSSI) to investigate, a person in his office ‌said.

France was coordinating with European counterparts because other countries could also be affected, the person ‌said, ‌adding that authorities were assessing whether other French companies were at risk.

Felix Aime, a ‌senior cyber threat intelligence analyst at Sekoia Threat Detection and Research, said Spain, Portugal, ⁠Poland, Germany and Belgium had also been affected.

Carrefour said 80 of its supermarkets had been hit, while Monoprix said five percent of its stores were affected.

Les Mousquetaires, owner of retailer Intermarche, said fridges at around 150 of its stores were heated up to 50 degrees Celsius for six hours overnight.

A spokesperson said all affected food had been discarded ​to eliminate health risks.

Paris resident Geert de Clercq witnessed staff at an Intermarche in central Paris throwing cartfuls of defrosted frozen foods into a giant trash container, with molten ice cream sloshing out of broken ⁠tubs on the street.

Cooperative U CEO Dominique Schelcher said his supermarket group had also been targeted.

"Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented," he wrote on X.

E.Leclerc and Auchan did not respond to requests for comment.

There was no immediate estimate of industry-wide losses.

"Retail and wholesale play an essential role in keeping Europe supplied with the goods people rely on every day," said Christel Delberghe, director general at European retail association Eurocommerce.

"This incident underlines the importance of resilience across the entire supply chain."

Cold aisles controlled over the internet

Supermarket cold aisles are typically run by control panels that manage an entire store's fridges and freezers and can be ​accessed over the internet, which lets maintenance companies adjust them from anywhere.

The ⁠source close to Lecornu said ANSSI had identified a vulnerability in software supplied by Danish ⁠company Danfoss.

Danfoss said it was "aware of incidents in France affecting a limited number of refrigeration management systems".

The affected units "were running outdated firmware", Danfoss said, adding that ​it had "long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions". 

On August ‌9, cyber security firm Claroty's ⁠Team82 published research detailing vulnerabilities in the Danfoss AK-SM 800A controller.

According to the report, software updates issued by Danfoss addressed issues that could have allowed attackers to bypass authentication controls and execute code on compromised devices.

The attacks resemble disruptions reported at about a dozen US military commissaries in late August ‌that led to food losses after fridges were affected.