Hundreds of French Stores Affected by Cyberattack on Refrigeration Equipment

On the night of October 11-12, unknown individuals attacked the refrigeration management systems in hundreds of supermarkets across France. The devices were remotely switched to continuous defrost mode, causing food spoilage and fires. The attack was confirmed by Coopérative U head Dominique Schelcher. Estimates vary: AFP reports at least 300 Intermarché and Netto stores, while Les Mousquetaires owner cites about 180. Approximately one hundred Coopérative U locations, several E.Leclerc, 80 Carrefour supermarkets, and 5% of around 490 Monoprix stores were also affected. Temperatures rose to 50°C, and the defrost cycle in some units was extended from one to eight hours to delay alarms. The chains disposed of spoiled products and, in some places, closed refrigerated and frozen food sections.

Sekoia analyst Felix Aimé stated that the attack also affected other countries: Spain, Portugal, Poland, Germany, and Belgium. The Paris prosecutor's office has launched an investigation, led by the cybercrime unit. French Prime Minister Sébastien Lecornu has tasked the National Cybersecurity Agency with handling the incident. Intermarché head Thierry Cotillard estimated potential losses for the networks across the country in the tens of millions of euros, with the final damage unknown. The attack targeted systems of Danish manufacturer Danfoss: its controllers regulate temperature, initiate defrosting, and monitor equipment, with some connected to the internet for remote servicing.

Danfoss confirmed that most of the affected devices were outdated or running on non-updated software. Among them were the AK-SM800 and AK-SC355, which were discontinued in 2021 and 2016, respectively, while some current AK-SM800A models were using old firmware. The company stated that it had long advised transitioning to modern systems and installing updates, and is now updating software, strengthening security, and closing direct internet access. ANSSI head Vincent Strubel urged the immediate disconnection of AK-SM and AK-SC controllers from the network, and the French Trade Federation demanded transparency from Danfoss. In August, Claroty described vulnerabilities in the AK-SM800A that allowed bypassing authentication and executing code; Danfoss addressed these in firmware R4.3.1. Whether hackers exploited these flaws has not been established. In August, a cybercriminal stole data from 678,000 French taxpayers from DGFiP systems.