Fridges in French supermarkets hit by cyber attack

[Gordon_R]

Fridges in French supermarkets hit by cyber attack

Hundreds of stores were targeted by the overnight hack, which spoiled fresh and frozen food estimated to be worth millions of euros.

www.bbc.com

Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight.

The chief executive of Coopérative U said several of its supermarkets had been hit by the "extremely serious and unprecedented" attack.

More than 100 of the chain's supermarkets were targeted, while at least 300 stores from Intermarché and its Netto brand were affected, according to the AFP news agency.

Other major food retailers including Carrefour, Monoprix and E.Leclerc were also hit by the attack, which targeted software provided by Danish engineering firm Danfoss.

The software allows retailers to manage their cold units remotely.

Normally, supermarket freezers go through a short period of defrosting overnight, in which temperatures rise slightly. But here, the hackers ordered the units to heat up and stay hot.

Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified.

 

[now05ster]

Bruh. Where have we landed where a shop freezer has the ability to be hacked.

 

[gregmcc]

Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified.

So they knew about the vulnerability and did nothing about it.

 

[HAL 9000]

So they knew about the vulnerability and did nothing about it.

Had their 30-day free trial of McAfee 'Total Protection' Anti-Virus expired?

 

[Gordon_R]

So they knew about the vulnerability and did nothing about it.

The vulnerability was hard coded, I included this in the OP:

older models whose security software could not be updated

Do you mean the supermarkets or the manufacturer?

That's the price of convenience versus security: Outsourcing your refrigeration equipment maintenance...

 

[Johnatan56]

This was flagged back in August, this has a break-down of the exploit:

Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers

Team82 researched the attack surface of the Danfoss AK-SM 800A refrigeration controller platform and identified multiple vulnerabilities affecting the embedded web management interface. Team82 disclosed the vulnerabilities to Danfoss, which addressed them in a new firmware version. Successful...

claroty.com

Still a bit crazy that this was directly on the internet as well, this should at least have been on an internal one. Doesn't matter that the device can't be patched, should have been taken off of the internet, this is going to be interesting to see if insurance pays out.

The vulnerability was hard coded, I included this in the OP:

Just to add: hard coded in terms of the mathematical formula for the password was hard coded "code-of-the-day", in the article I linked (system serial + current day => same algorithm => master password, and serial number was easy to get).

The issue is that the older models it was a firmware patch, so had to be done manually for each one, and flashing the firmware lost all profiles/settings, so recalibrate etc., all of it, not being able to use any of the fridges anymore.

Still unsure why other guards weren't put in place so they can't connect to the internet etc. if known.

 

[gregmcc]

The vulnerability was hard coded, I included this in the OP:


Do you mean the supermarkets or the manufacturer?

That's the price of convenience versus security: Outsourcing your refrigeration equipment maintenance...

The manufacturer. Everything can be updated. They chose not to due to cost vs risk.

 

[Gordon_R]

Reuters has a bit more technical detail:

https://www.reuters.com/business/retail-consumer/french-supermarket-chain-intermarche-hit-by-cyberattack-150-stories-targeted-2026-10-12/

Prime Minister Sebastien Lecornu has instructed France's National Cybersecurity Agency (ANSSI) to investigate, a person in his office said.

France was coordinating with European counterparts because other countries could also be affected, the person said, adding that authorities were assessing whether other French companies were at risk.

Supermarket cold aisles are typically run by control panels ‌that manage ⁠an entire store's fridges and freezers and can be accessed over the internet, which lets maintenance companies adjust them from anywhere.

The source close to Lecornu said ANSSI had identified a vulnerability in software supplied by Danish company Danfoss.

Danfoss said it was "aware of incidents in France affecting a limited number of refrigeration management systems".

The affected units "were running outdated firmware", Danfoss said, adding that it had "long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions".

On August 9, cybersecurity firm Claroty's Team82 published research detailing vulnerabilities in the Danfoss AK-SM 800A controller. ⁠According to the report, software updates issued by Danfoss addressed issues that could have allowed attackers to bypass authentication controls and execute code on compromised devices.

The attacks resemble disruptions reported at about a dozen US military commissaries in late August that led to food losses after fridges were affected.

 

[Gordon_R]

This was flagged back in August, this has a break-down of the exploit:

Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers

Team82 researched the attack surface of the Danfoss AK-SM 800A refrigeration controller platform and identified multiple vulnerabilities affecting the embedded web management interface. Team82 disclosed the vulnerabilities to Danfoss, which addressed them in a new firmware version. Successful...

claroty.com

Still a bit crazy that this was directly on the internet as well, this should at least have been on an internal one. Doesn't matter that the device can't be patched, should have been taken off of the internet, this is going to be interesting to see if insurance pays out.

Just to add: hard coded in terms of the mathematical formula for the password was hard coded "code-of-the-day", in the article I linked (system serial + current day => same algorithm => master password, and serial number was easy to get).

The issue is that the older models it was a firmware patch, so had to be done manually for each one, and flashing the firmware lost all profiles/settings, so recalibrate etc., all of it, not being able to use any of the fridges anymore.

Still unsure why other guards weren't put in place so they can't connect to the internet etc. if known.

Noted. I just saw the Reuters detail after your post.

 

[Gordon_R]

The manufacturer. Everything can be updated. They chose not to due to cost vs risk.

Google says these things are not cheap:

The Danfoss AK-SM 800A series system managers generally range from about $2,900 to $6,600 USD depending on the specific model variant, retailer, and whether it includes features like Wi-Fi or LON modules.

 

[HAL 9000]

If the power grid was hacked, do you have enough food to feed your family?

A bunch of French citizens are probably asking that today...

The attack targeted hundreds of French grocery stores and it looks like smart technology could be a real weakness for modern nations after this.

The office of Prime Minister Sébastien Lecornu told POLITICO that he is 'personally monitoring the situation' after cyberattacks targeted the refrigeration systems of several major supermarket chains. Lecornu has asked the country's cybersecurity agency ANSSI to look into it, his office added.

News reports on Monday said that hundreds of supermarkets were affected. Intermarche and Cooperative U, two French supermarket chains, told AFP that they had been affected. Intermarche told AFP that affected stores will have to throw away affected fresh and frozen food.

It really makes you pause when you consider that smart fridges in multiple American military bases all stopped working at once just a month ago.

More from France courtesy of Yahoo!:

Paris prosecutors confirmed the attack, which reportedly also hit other major chains, and also indicated it had sparked fires.
BFM TV said hackers 'managed to remotely trigger the forced defrosting of the refrigeration systems in numerous stores'.

Those branches that were affected will have to 'throw away all of the products' that are fresh and frozen, Intermarche told AFP ...

According to a source close to the issue, the refrigeration control systems from Danish manufacturer Danfoss were targeted ...

A person close to French Prime Minister Sebastien Lecornu said France's cyber security agency had already identified 'a vulnerability in software supplied by a Danish company and has contacted the vendor'.

I don't think Denmark has launched an unprovoked attack on France ... so it's probably someone else who hijacked the Danish company.

Regardless of who did it, you now live in an era when hackers can disrupt the food supply of an entire nation in ten thousand different ways.

With the push of a button.

Cyberattack cripples store freezers across France through "forced defrosting"

If the power grid was hacked, do you have enough food to feed your family?

notthebee.com

 

[WanderingMind]

Some things really should just stay of the internet. Like fridges.

The only thing of a fridge that might be online is the temperature meter. To alert who ever if something broke and is to warm.

If it can be controlled then it can be hacked.

 

[Hemi300c]

I'd have a meltdown

 

[Gordon_R]

Some things really should just stay of the internet. Like fridges.

The only thing of a fridge that might be online is the temperature meter. To alert who ever if something broke and is to warm.

If it can be controlled then it can be hacked.

You realise that remote monitoring without the ability to control is almost pointless? Imagine there is a heatwave, or change in seasons, requiring adjustments to 200 thermostats. Are you going to send a crew of technicians to work on each one? Yes, there are tradeoffs, but also valid reasons for both choices.

 

[Binary_Bark]

"Smart fridges" might seem like a great idea at first, both in shops and at home. But how much thought goes into the security of an appliance meant to keep your food cold?
The average Joe won't think, "Can my new fridge be hacked?" until something goes wrong. The same goes for smart toasters, washing machines and pretty much any other household appliance connected to the internet.
Every connected device is another potential attack surface, often with little real benefit to justify the added risk.
Sometimes, a normal fridge that keeps your food cold is more than good enough. Not everything needs to be smart.

 

[neoprema]

Some things really should just stay of the internet. Like fridges.

The only thing of a fridge that might be online is the temperature meter. To alert who ever if something broke and is to warm.

If it can be controlled then it can be hacked.

This is probably how it started…

“Can we monitor our fridges remotely”

Then later, when changes were needed the demand became:

“Can we manage our fridges remotely”

Still no excuse though not to have a proper patch management in place and upgrade path for your firmware that doesn’t brick it.

But, the age old problem of “this would be easier to manage if it were internet accessible” comes into play where we look for the easiest route. There’s probably no use case the manufacturer considered where someone just NATs traffic over to them from the internet.

But the same happens daily with VMware, RDP, file servers, and and and…

 

[rustypup]

You realise that remote monitoring without the ability to control is almost pointless?

Behaving responsibly is not.

We face the exact same challenge in the PLC fleets. You can't tear out a 2-tonne piece of equipment every year or so.

Isolated network, proper MFA with workflowed approval and tightly controlled, recorded, access alongside robust change control.

No internet. Not even if it's sooooo convenient.

It's not difficult. It just takes effort. Apparently someone decide the effort wasn't warranted. Guess they're learning now what the tradeoff was.

 

[PhireSide]

 

[WanderingMind]

This is probably how it started…

“Can we monitor our fridges remotely”

Then later, when changes were needed the demand became:

“Can we manage our fridges remotely”

Still no excuse though not to have a proper patch management in place and upgrade path for your firmware that doesn’t brick it.

But, the age old problem of “this would be easier to manage if it were internet accessible” comes into play where we look for the easiest route. There’s probably no use case the manufacturer considered where someone just NATs traffic over to them from the internet.

But the same happens daily with VMware, RDP, file servers, and and and…

You are correct, but we all know security for these things is always secondary.

We are living in a Battlestar Galactica scenario now.
If you don't want it to be hacked, then don't have it online.

 

[Magnum]

I would like to see them hack this.....
They are limited by the technology of my time.