Cyberattacks crank French supermarket refrigeration systems up to 50°C

French supermarkets have fallen victim to cyberattacks that caused refrigeration systems to reach dangerous temperatures, leading to the spoilage of perishable food and forced store closures. Major retailers, including Carrefour, Coopérative U, Intermarché, Monoprix, and others, were impacted. The criminals behind the attacks raised temperatures to unsafe levels, causing fires in some cases.

The affected equipment included cold-storage units used for storing food before it reaches supermarket shelves. The criminals exploited vulnerabilities in refrigeration controllers produced by Danish company Danfoss. French authorities have not identified the entry point or confirmed exploitation of these previously disclosed vulnerabilities, although the manufacturer stated that affected stores were using outdated firmware.

Experts noted that these vulnerabilities were easily exploitable due to a predictable authentication method. Claroty, a security firm, found a hidden authentication mechanism in the AK-SM 800A platform that bypassed the configured administrator password, allowing anyone to generate a valid daily code and gain administrative access.

Danfoss stated that the French supermarkets affected were running outdated firmware and recommended keeping systems updated. The Register asked Danfoss if the previously disclosed bugs were exploited, and whether the same bug was used in August to compromise US military commissary refrigerators, which led to food losses. Cert-FR reported numerous compromises of Danfoss AK-SM and AK-SC controllers.

Authorities advised disconnecting or restricting network access for suspected compromises, recommending factory resets, security patches, credential rotation, account checks, and full reconfiguration. The French food supply chain was deeply affected, with multiple supermarkets reporting stock issues and closed websites.