Hackers Attack French Supermarket Freezers Causing Food Loss

Hundreds of French supermarkets have fallen victim to a cyberattack that caused their refrigeration units to heat up, spoiling vast quantities of food and even causing some fires.

See Also: Secure Every Pump Station, Lift Station and Remote Site

Thierry Cotillard, president of the Mousquetaires Group, parent company of the affected Intermarché and Netto chains, told the BFM Business news channel that the experience had been "hell."

"The attack triggered the defrost cycle on all our refrigerated display cases" and raised their temperatures to 50 degree Celsius - 122 degrees Fahrenheit - Cotillard said. "It's a disaster, it's unprecedented, never seen before on this scale." Cotillard said 300 Intermarché and Netto stores had been hit. Industry losses could reach "tens of millions of euros," he said.

The Paris Prosecutor's Office confirmed to ISMG on Tuesday morning that its cybercrime division had taken up the case under its national jurisdiction, and the investigation "should make it possible to identify the victims and establish the link with the damage reported by them in terms of food losses and fires."

The E.Leclerc supermarket chain confirmed that some of its outlets had been hit in the attack, which took place overnight between Sunday and Monday. The Monoprix chain was also affected. Parent company Groupe Casino told ISMG on Tuesday that 5% of Monoprix stores were struck and its teams were racing "to restore the situation and restock the shelves as quickly as possible."

The French retail trade outlet Je Bosse en Grande Distribution reported that the Carrefour Market chain was similarly affected, but that company had not provided confirmation at the time of publication.

"Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented," Dominique Schelcher, the chief executive of Coopérative U - one of the affected grocery groups - said Monday on social media. "It is unacceptable."

Schelcher told broadcaster RTL that 80 U stores out of 2,000 had been affected and the costs would vary according to the size of store - "180,000 or even 200,000 euros" for a supermarket, and "a few tens of thousands of euros" for smaller outlets.

Unsecured Danfoss Controllers Exploited

The common link is Danfoss, the Danish refrigeration giant, which told BFM Business that most of the affected equipment used its old AK-SM800 and AK-SC355 system controllers, "which have reached the end of their life cycle and no longer receive software or security updates." Some of the stores were using the newer AK-SM800A systems but running "outdated firmware," the company said.

Some security experts have dubbed the attacks "Defrost Bypass."

Cybersecurity firm Claroty reported in August that it had found multiple vulnerabilities in the AK-SM800A's embedded web management interface. Once notified, it said, Danfoss had released a new firmware version in August last year.

Claroty's Team82 research team said at the time the findings demonstrated "how undocumented functionality, insecure command construction and dynamically modifiable web server configurations can combine to create powerful attack chains against internet-accessible cyber-physical systems."

A hidden authentication mechanism allowed attackers to bypass standard password verification by using a specially generated "code of the day" that was "generated internally from the device's current date and time." Reverse-engineer the routine, and the code-generating algorithm could be reconstructed and abused. A command-injection vulnerability enabled remote code execution, and a separate flaw could have been used to "trigger a denial-of-service condition."

"The cyberattack on Coopérative U should raise the alarm for any company that is responsible for handling temperature-sensitive products," Claroty CTO Aamir Preminger said in an emailed statement on Monday. "Industrial control systems such as refrigeration controllers are often assumed to be on safely isolated networks, however, our research found many of these devices are directly exposed to the public internet. While this convenience significantly reduces maintenance costs by allowing engineers to troubleshoot issues remotely, it also lowers the barrier to entry for attackers."

Claroty also said Monday that it had become important to anticipate large-scale attacks because of artificial intelligence's newfound utility in scanning systems for access control issues and vulnerabilities, and also because of "geopolitical conflict spiking activity against critical infrastructure."

Hallmarks of Russian Hacking

No group has yet claimed responsibility for the attacks, but experts said Moscow is a likely culprit. "It's of course too early to speculate but this screams Russian APT - in many ways it's the perfect target," Ian Thornton-Trump, CISO of Inversion6, told ISMG.

The incident took place in the context of Russia's accelerating hybrid war against Europe, which generally involves sabotage and cyberattacks that are hard to attribute definitively. France is one of Ukraine's most steadfast backers in its fight against Russia, although there is no confirmation of the attackers' identity, nor indeed of which specific vulnerabilities they exploited.

"From a political perspective, attacks on food distribution cut to the core of the confidence in the government's ability to protect the food supply and that is exactly the outcome Russian APTs would be looking for," Thornton-Trump said.

Christophe Hansen, the European Commissioner responsible for food and agriculture, tweeted that "the weaponization of food has become a reality," in response to the incident.

Moscow has a long history of using advanced persistent threat groups to run information warfare or "active measures" campaigns against adversaries, including hack-and-leak attacks as well as distributed-denial-of-service disruptions . Many of these efforts are designed to undermine a country's leadership and weaken morale.

ANSSI, the French cybersecurity agency, published a Monday alert urging supermarkets to "disconnect or filter access to AK-SM and AK-SC instances." It also noted that "exposing a management interface to the internet is contrary to best practices" and, "if remote administration is essential, a first temporary measure could be to restrict access to trusted IP addresses."

US Military Commissary Probe

These aren't the first recent hack attacks targeting refrigeration systems. They follow a series of incidents in late August at military commissaries, which sell food and household goods at a discount to service members, across the United States.

As Substack author "M. Elizabeth" first reported , "near-simultaneous refrigeration failures or significant issues" appeared to affect at least 14 military commissaries across 11 states.

"The coordinated nature and timing of these outages strongly suggests a sophisticated cyberattack targeting critical infrastructure systems within the military supply chain," the cloud network security firm Aviatrix said in a September blog post . "This incident highlights the growing threat to operational technology and IoT devices within critical infrastructure environments."

One of the affected facilities, at U.S. Army Fort Huachuca in southeast Arizona, said on Aug. 26: "Due to an overnight equipment failure at the Fort Huachuca Defense Commissary Agency store, ALL freezers went into defrost mode - ALL frozen food has spoiled. At this time, there are NO frozen food items for sale until further notice."

Subsequently, Army and Air Force special agents launched an investigation into what the Pentagon has called the "possible refrigeration disruption," reported Stars and Stripes.

Food Production Plant Attacked

Another attack targeting refrigeration controllers happened in May at a food-production plant in an unnamed country - possibly Israel - investigated by Tel Aviv, Israel-based incident response firm Profero. The firm has attributed the attack to Cyber Isnaad Front, which it says is a persona tied to Iran's Islamic Revolutionary Guard Corps.

Investigators said attackers targeted two industrial refrigeration systems - one old, one new - that use carbon dioxide as their refrigerant. For the older system, attackers "changed parameters only: setpoints, protection thresholds, alarm and alert limits," altering the target temperature from 2 degrees Celsius (36 degrees Fahrenheit) to 50 C. While this would have led to products having to be destroyed, plant engineers quickly detected and restored the correct settings.

But the attackers also targeted a newer controller during what investigators found was a days-long effort that involved "reengineering the controller from scratch, tracing every wire in the electrical panel against the electrical schematic, identifying it in the program and redefining it in the controller." After, the attackers set the device to circulate CO2 continuously, leading to it bleeding out, valves failing and three expensive and difficult to replace compressors being destroyed.

"The system did not return to normal operation for the better part of a week, and one replacement compressor still has to come from the manufacturer overseas," Profero reported at the time.