Cyberattacks crank French supermarket refrigeration systems up to 50°C

A series of cyberattacks targeted the refrigeration systems of numerous French supermarkets, causing temperatures to soar up to 50°C (122°F). Major retailers including Carrefour, Coopérative U, Intermarché, Monoprix, and others were affected, forcing them to discard perishable food items and leaving stores without fresh produce.

The compromised equipment includes cold-storage units utilized to store food before it reaches supermarket shelves. The hackers behind the attack raised the temperatures to unsafe levels, leading to food spoilage in some cases and even starting fires. The affected retailers used refrigeration controllers produced by Danish company Danfoss.

While authorities have not identified the entry point or confirmed the exploitation of the previously disclosed vulnerabilities, the manufacturer claims the stores were running outdated firmware. Security experts highlight that the vulnerable authentication method is easily scriptable and relies on a unique but predictable code generated from the device's current date.

This technique allows anyone to generate a valid daily code and gain administrative access. The incidents underscore the risks associated with connecting industrial control systems, such as refrigeration controllers, to the internet, as it enables remote troubleshooting but also lowers the barrier to entry for attackers. Authorities recommend disconnecting or restricting network access for suspected compromises, conducting factory resets, applying security patches, rotating credentials, and reconfiguring accounts.