French investigators pursue refrigeration attack affecting at least 350 supermarkets

French investigators were seeking the hackers behind a supermarket refrigeration attack on October 13, with no public claim of responsibility or ransom demand. Reuters’ report carried by CNA says at least 350 supermarkets were caught up in the attack, a small fraction of the country’s total.

The attackers overrode temperature controls at stores in groups including Carrefour, Monoprix, Intermarche and Cooperative U. Reuters observed employees at some Paris supermarkets disposing of spoiled meat and frozen goods in large rubbish containers.

The absence of a claim or demand has puzzled investigators, according to a source familiar with the inquiry. The precise way the systems were compromised has not been publicly disclosed, leaving responsibility and the attack route unresolved.

The refrigeration systems used software from Danish supplier Danfoss. On October 12, the company said many affected units had reached the end of their supported life and no longer received software or security updates, or were running outdated firmware.

Firmware is the software embedded in equipment that helps control its operation. Danfoss said it had advised customers to keep supported systems updated and migrate older systems to current-generation products. It declined to add further comment on October 13.

Reuters reports that Claroty disclosed weaknesses in the Danfoss AK-SM 800A controller on August 9. Those weaknesses could have allowed intruders to bypass identity checks and run code on a compromised device; software fixes had since been provided.

Three cybersecurity specialists told Reuters that the refrigeration attack appeared easy to carry out. Experts pointed to the combination of internet-accessible control interfaces and failure to adopt software updates, while the exact mechanism used in this attack remains undisclosed.

Ken Munro, a partner at Pen Test Partners, described the weaknesses as making intrusion relatively straightforward. He suggested the incident could have involved young people causing disruption, questioned why a nation-state attacker would target only a subset of French refrigeration systems, and said the lack of a ransom demand could suggest limited appreciation of the commercial losses. His comments were assessments of the pattern, rather than an identification of the perpetrators.

Reuters used the Shodan internet-scanning service to identify at least 4,500 Danfoss interfaces still visible online on October 13. It could not independently determine how many ran vulnerable software. The visible-interface count is therefore distinct from both the number of affected stores and a confirmed count of insecure devices.

French scanning company Onyphe said only a small minority of the devices appeared to run the latest software. It said outdated and vulnerable versions remained widely represented among publicly accessible interfaces.

The investigation concerns the disruption already experienced by retailers, while the scanning findings describe a continuing exposure of control systems online. The version and configuration of those systems determine questions that visibility alone cannot answer.