Thousands of supermarket fridges still exposed after cyberattack
No group has claimed the attack, and experts warn thousands of similarly exposed devices remain online as a separate incident disrupts Dutch grocer Albert Heijn.
French investigators are probing the hackers responsible for compromising refrigeration units at over 350 supermarkets across the country. The incident forced employees to discard spoiled meat and frozen food, affecting stores of major chains Carrefour, Monoprix, Intermarché, and Coopérative U. The attack occurred when the hackers manually manipulated the fridge temperatures, leaving investigators puzzled due to the absence of a ransom demand or claim of responsibility.
Cybersecurity experts from France's cybersecurity agency discovered that the breach impacted fridges running software from Danish firm Danfoss, as well as Copeland and Dixell systems. Reuters reported finding at least 4,500 Danfoss interfaces online, while scanning firm Onyphe noted that outdated versions were still predominantly present among publicly accessible interfaces.
Danfoss revealed that many of the affected units had reached their end of life, no longer receiving software or security updates or running outdated firmware. Copeland, which owns Dixell, acknowledged the vulnerability and stated that they are currently collaborating with impacted customers to mitigate the risk.
Experts attribute the incident to basic cyber hygiene issues, emphasizing that an inadequate response could lead to a significant problem, such as defrosted food. Ken Munro, a partner at British firm Pen Test Partners, suggested that the attack might have been carried out by curious individuals rather than a state-sponsored group. He questioned the strategic rationale behind targeting a subset of French fridges among numerous nations with similar equipment.
In response to the incident, Ahold Delhaize, which owns Albert Heijn, began a controlled restart of its systems following a cybersecurity incident. Dutch cybersecurity watchdog NCSC found no connection between the French attack and the Dutch incident. Albert Heijn identified servers in the US, Poland, Moldova, and Turkey as part of the attack, although the exact location of the hackers remains unclear due to the ease of routing traffic through various countries.
The incident highlights the fragility of food stocks, with shops and distribution centers holding only around six days' worth of supply, replenished continuously through just-in-time IT systems that are vulnerable to failures and depend on the power grid. A recent report by Clingendael and Erasmus University advised households to maintain eight days of emergency food rather than the previously recommended three.
The report suggested that severe weather combined with a major power and IT outage could take two weeks to recover from.
Written by urgent.news from Euronews's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
