Are French supermarket fridge hackers just youths shopping for kudos?

Described as ‘one of the oddest cyber events’, the widespread freezer attacks may be part of a growing trend of young men wreaking havoc to win approval from their peers

One mother’s mission after the murder of her gamer son

‘After any woman falls to her death, police should think: domestic abuse’

Imagine reaching into a freezer at your local Intermarché only to find that the frog legs you planned to serve for dinner had been lightly broiled in their packet. Quel cauchemar!

That was the situation facing French shoppers on Monday morning after hackers found a way to raise the temperature of refrigerators and freezers ​at hundreds of retailers across the country – in some cases by up to 50C – leading to several fires and millions of euros of spoiled food.

More than 300 sites owned by French supermarkets Intermarché, Monoprix, Carrefour and E Leclerc were hit due to their dependence on software that allows cold units to be managed remotely. The software was provided by Danish company Danfoss. Fridges in Spain, Portugal, Poland, Germany and Belgium were also affected.

Ciaran Martin, former chief executive of the UK National Cyber Security Centre, has described the attack as “one of the oddest cyber events” he has ever seen. No criminal group or state-affiliated actor has yet claimed responsibility, but a similar type of attack appears to have affected commissary freezers at six US military facilities in August.

“No one’s really claimed anything, which is odd,” said Aiden Sinnott, cybersecurity researcher at Sophos. “They haven’t stolen any data. There’s nothing they can really hold to ransom here. Often state- actors are quiet, but that’s usually because one of the main purposes is espionage… whereas a disruptive attack like this is pretty noisy.”

Could it be that these hackers weren’t interested in sabotage or financial reward, but instead were seeking approval from their peers? In recent months intelligence firms have noted the rise of a new class of hacker: young, western, predominantly male groups armed with AI, who have been behind several high-profile retail hacks including the £300m shutdown of M&S last year.

Kudos for carrying out high-profile disruption is shared within online communities. The largest of these is known as “the Com”, which the FBI said “has expanded to include thousands of people”, mostly English-speaking, aged 11 to 25.

Sinnott notes that one hacker group has even set up an “in the press” section on its leak website – a kind of twisted testimonials page valorising the hackers’ ability to wreak havoc.

One mother’s mission after the murder of her gamer son

‘After any woman falls to her death, police should think: domestic abuse’

He also suggests the desire for clout may partly explain why so many hacks in recent weeks have targeted retail outlets. The Foschini Group, the South African owner of UK high street brands Hobbs and Whistles, this week announced that some of its IT systems had been hacked. Last week a hacker group called Xuanye managed to hijack the app notification system of Asos, sending a mobile alert to millions of customers in what appears to be an attempt to manufacture maximum fear.

“It helps the threat actors because it’s all extra leverage. They want to put as much pressure as possible on the victim to make them pay,” said Sinnott.

This could soon get a lot more serious. The UK’s AI minister warned this week that it was “likely, if not inevitable” that government systems would be breached, following the incident when a rogue OpenAI agent hacked Australia’s health service in June. Kanishka Narayan says he wants cyber security “discussed in every boardroom in Britain”.

A Lords amendment to the cyber security and resilience bill that is moving through parliament would seek to make senior executives personally liable for penalties if their organisation’s cyber-compliance failure occurred through their “consent, connivance, neglect or carelessness”.

Serious breaches will have to be reported within 24 hours, including overnight and at weekends, and can result in fines of £17m or up to 4% of global turnover, whichever is larger. In July last year the Office said it would ban critical infrastructure operators from paying ransoms. Supermarkets would not count as an “essential service” under the bill.

Photograph by Fred Tanneau/ AFP via Getty Images