Several chains of French stores were subjected to an unprecedented cyber attack on Monday, which disrupted their cooling systems. It is believed that hackers remotely altered the temperatures of these devices, leading to spoilage of fresh and frozen product stocks and losses estimated in the millions of euros. The Danish company Danfoss, which manages the cooling systems, explained that "the majority of the affected units are old devices (...) that no longer receive software or security updates."
A cyber attack, the first of its kind, targeted hundreds of major French stores on Monday, including "Intermarché", "Cooperative U", "E.Leclerc", and "Metro", as it affected the cooling control systems managed by the Danish company Danfoss.
300 Stores Affected
About 300 stores from the "Intermarché" and "Neto" chains, which belong to the "Les Mousquetaires" group, were impacted, along with fewer than a hundred stores from "U". This was reported by the private channel "BFM".
The group confirmed to the channel, stating: "Following a cyber attack believed to have targeted a provider of cooling system management services in stores, some equipment for preserving fresh and frozen products ceased to operate. The chains 'Intermarché' and 'Neto' have taken all necessary precautions to withdraw products in these units as quickly as possible."
It is believed that temperatures were altered remotely in some stores, causing significant spoilage of fresh and frozen products.
In the "Alsace" region, for example, losses for "Intermarché" and "Cooperative U" reached around 270,000 euros. This warns of losses, at the national level, estimated at "several million euros," according to France Inter radio.
Experts describe the attack as "unprecedented" and "very serious," and it also targeted "E.Leclerc," which is the largest chain of stores in France. Around 5% of "Monoprix" stores were also affected, according to France Info.
Dominique Schelcher, CEO of "Cooperative U," confirmed the attack on the platform "X," considering that "targeting vital equipment for preserving fresh products and for the food supply of the French people is extremely dangerous and unprecedented, and it is unacceptable."
For its part, the "E.Leclerc" group told France Info that "a cyber attack targeted one of its suppliers of cooling equipment," which "affected the operation of cooling devices in many stores." The group added that "teams are working in coordination with the supplier to assess the situation and take all necessary measures to ensure the safety of the cold chain."
The attackers exploited an electronic function designed to protect cooling facilities, targeting old versions of the Danish company Danfoss's cooling device software, specifically those that predate version four.
This system is used in a large number of French stores, which may explain the scale of disruptions and damages resulting from this attack. Alongside major distribution chains, stores like "Metro" and other independent shops, such as butcher shops, may also have been affected.
Under normal circumstances, cooling systems utilize an automatic defrost function, through which ice buildup on the equipment can be cleared. Industry specialists say this function can be programmed to perform defrosting for two hours within a 24-hour period, for example.
Defrost System Hacking
However, it is likely that what happened on the night of Sunday to Monday was that the attackers "hacked" this function and forced the system into a continuous and enforced defrost phase. They set the temperature at 50 degrees Celsius, causing a temperature rise for several hours instead of maintaining the products' coldness.
The "Les Mousquetaires" company, owner of the "Intermarché" retail chain, reported that the chain was subjected to a cyber attack that affected around 150 of its stores.
It stated that "the temperature in the refrigerators rose to 50 degrees Celsius for six hours, and the company had to dispose of all food items to avoid any health risks." Upon opening the refrigerators and freezers, "a wave of heat emanated," according to a source in the sector.
It is believed that the attack began around midnight in some stores, providing ample time for temperatures to rise, resulting in the spoilage of all products stored in the refrigerators. Other stores that were attacked late at night managed to save part of the fresh goods, according to France radio.
Refrigerators Set at 50 Degrees
The "Les Mousquetaires" group mentioned that "Danfoss," the Danish company (which manages the group's cooling systems), was subjected to a cyber attack on the night from Sunday to Monday, during which the temperature of the freezers and refrigerators was set to 50 degrees Celsius." The Intermarché chain is the most affected, as the attack targeted between 200 and 300 of its stores in France.
It is noted that the stores affected by this cyber attack are required to follow specific procedures, including emptying the cooling units, employing a bailiff to document the state, or even disposing of food items. The "Les Mousquetaires" group stated that it had never witnessed a cyber attack targeting cooling systems, indicating that an attack "of this magnitude is a precedent."
For its part, the Danish company Danfoss explained that "the majority of the affected units are old devices (...) that have reached the end of their useful life and no longer receive software or security updates."
Crisis teams have been formed to work with specialized companies in cooling systems and support the affected stores.
According to France Info radio, sources close to Sébastien Lecornu reported that the Prime Minister "is personally following the file." He requested the National Cybersecurity Agency (ANSSI) to take charge of monitoring this issue.
Security Vulnerability
Last August, the research team "Team 82" of the cybersecurity firm "Claroty" prepared a report on "security vulnerabilities" in the AK-SM 800A cooling control units produced by Danfoss. The team discovered a "potential vulnerability that allows bypassing the authentication mechanism," which could enable a "malicious entity" to take control of "privileged permissions and access the web-based management interface" of the device.
The researchers reported that they informed Danfoss of the matter, which subsequently "addressed the mentioned vulnerabilities" in a new version of its software. Team 82's report also urged customers using the AK-SM 800A model to upgrade to the new version "as soon as possible."
The National Cybersecurity Agency has already identified a security vulnerability in the software provided by the Danish company and communicated with the software developer. The French agency is also coordinating with its European counterparts to intensify efforts, given the possibility of other countries in the bloc being affected, and is seeking to identify the affected French companies.