French supermarket fridges cyber attack: what it means for F&B

Hundreds of French supermarkets experienced a cyber attack on October 12. The attackers took control of fridges and heated them to 50°C (120°F) for several hours overnight. Food thought to be worth millions of euros was spoiled.

The attacked software was provided by Danish engineering firm Danfoss. At the time of publishing, no one has claimed responsibility for the attack.

“Following a cyber attack reportedly affecting a service provider that manages refrigeration systems in stores, some fresh and frozen food display units are out of service,” says a spokesperson for Groupement Mousquetaires, one of the most heavily affected supermarket groups. “Intermarché and Netto have taken all necessary precautions to remove the products from these units as quickly as possible. There are 300 stores concerned. We don’t have further information currently.”

Other chains affected include Coopérative U, Carrefour, Monoprix and E.Leclerc.

Why is the food industry being targeted?

“The food industry is part of the critical national infrastructure of most countries and is therefore a high-value target for cybercriminals,” says Dr Jason Nurse, reader in cyber security at the University of Kent. “They’re well aware that disruptions could cause significant harm, so businesses and governments will need to take these threats seriously. This may well result in organisations engaging with the criminals, as we’ve seen in the past.”

But supermarkets are not the only part of the supply chain that are at risk. Manufacturers are also in the firing line.

“Everyone is a potential target,” says Nurse. “The big concern supply chains is that a security breach at one organisation could expose the entire chain. This is why businesses need to focus on cyber resilience, as well as technology and agreements that protect both themselves and their partners.”

This comes after a new report from Zscaler ThreatLabz found that manufacturing is one of ransomwares most targeted industries. However, no threats or demands have yet been reported in this recent case.

What do we know the French cyber attack?

“Our team has been tracking the exposure of these refrigeration control systems globally,” says Félix Aimé, senior CTI analyst at Sekoia Threat Detection & Research (TDR). “Using Censys data, we identified over 2,700 StoreView systems reachable over the internet, with approximately 1,700 located in France.

“While France is heavily affected, with nearly 50% of its exposed installations currently offline (representing almost 90% of all offline systems observed across Europe), the situation in other European countries remains uncertain. Systems are also exposed in countries such as Spain, Portugal, Poland, Germany, or Belgium.

“However, in these countries, total numbers are very low. For example, when a country only has a handful of exposed units and a few go offline, that fluctuation can easily stem from routine maintenance, network disconnects, or local administrative actions. At this stage, we cannot confirm that retail networks outside France were intentionally targeted. Current indicators strongly suggest that the offensive campaign specifically targets France, but further investigations remain necessary to get a full picture.”

The attack vector (the route a cybercriminal takes to gain unauthorised access to a system) does not appear complex, he says.

“These control systems were directly accessible over the internet, though it remains unconfirmed whether initial access resulted from a specific vulnerability or default credentials. Given how long these installations have been exposed online, access was likely possible for an extended period.

“Based on our observations, systems appear to have been disabled or destroyed by threat actors after temperature parameters were modified. The fact that roughly half of the French installations suddenly stopped responding points toward direct adversary action rather than incident response teams manually unplugging equipment.

There are indications that some systems may have been fully wiped or rendered unusable, he says, which would force a complete rebuild of the refrigeration control setup, though this remains to be fully confirmed. “While technical teams work on remediation, this disruption to cold chain operations carries potentially significant financial and media impacts for affected organisations.”

Any part of the supply chain can be affected

“The food industry has certainly been on the receiving end of malfeasance here,” says Daniel Dresner, professor of cyber security at the University of Manchester. “But one needs to consider the motivation. Was it by someone or a group deliberately wanting to do damage to the food industry (or particular parts of it); someone or a group wanting to satisfy themselves of their capabilities; someone or a group with another motivation?”

This sort of criminal activity can affect any part of the supply chain if it has facilities connected to the internet, he says. And it might not be a direct connection. “Its operational technology may be connected to its information technology so criminals may have a soupçon of vulnerabilities in hardware or software that they can exploit to get access and do bad things. However, in these days of remote monitoring adjustment, it’s likely that the interference was direct.”

How can F&B protect itself?

Interested parties in the supply chain need to take steps to protect themselves right now, says Professor Dresner. “Part of the challenge is the interconnection and the perceived obligations we have on those we’re connected to protect their own systems,” he says.

In the UK, “many attacks will be thwarted by the ‘cyber 5-a-day’ of the Cyber Essentials standard”. This is the UK’s government-backed cyber security certification scheme that aims to help organisations protect themselves from cyber threat, and its pillars can be learned from by companies across Europe.

“This mandates properly installed and set up firewalls, unique and complex passwords with a second level of authentication like one-time PIN (or a passkey), sensible set-ups where default accounts (which anyone buying a product will have) are disabled, separation of responsibilities so not everyone can alter important settings, good anti-malware, keeping software updated, and removing unused software),” says Professor Dresner.

“Doing this with a connected thermostat on a refrigerator is likely to be trickier than doing it on your desktop computer, and that’s how many different fridges, from how many different manufacturers, with how many different direct and indirect connections to the internet? This is serious.”

He also points out that certification is not a talisman against attack or compromise, and there is much more to it. “Doing the things required for certification is good practice, a place to start with cyber security.”

As the whole supply chain becomes more internet-connected, every appliance potentially becomes a target for attackers. All companies, big and small, should make cyber safety an immediate priority.