Attack on cold storage in France: what to ask the supplier and equipment service technician
Attackers raised the temperature in the cold rooms of hundreds of French supermarkets to 50°C. A similar backdoor may exist in any company that has network-connected devices and remote servicing.
Six hours at 50 degrees
On the night of October 11-12, attackers took over the controllers of cold rooms and freezers in hundreds of French supermarkets. They raised the temperature in them to 50 degrees Celsius and kept it there for about six hours. The stores had to dispose of food, and fires broke out in some facilities. The Paris prosecutor's office launched proceedings. Prime Minister Sébastien Lecornu ordered an investigation by ANSSI, the French agency for network and information security.
The scale of the attack is still unclear, and sources give different numbers. Les Mousquetaires says it affected about 150 Intermarché stores. AFP reports at least 300 Intermarché and Netto outlets and more than 100 Coopérative U stores. Carrefour reported problems in 80 supermarkets, and Monoprix in 5 percent of its stores. Intermarché CEO Thierry Cotillard estimated on BFM TV that the entire sector's losses amounted to tens of millions of euros in a single day. This was an assessment from an interview, not an official accounting of losses. Some stores have already resumed operations.
Common denominator: a controller visible from the internet
Cold rooms in supermarkets are operated from network-connected panels. This allows the service company to change their settings remotely. According to sources close to the French government, ANSSI pointed to a vulnerability in the software of Denmark's Danfoss. The manufacturer admitted that most of the attacked devices were older products or current models with outdated firmware. It named the AK-SM800 controller, discontinued in 2021, and the AK-SC355, discontinued in 2016. Neither of them receives security updates anymore.
In August, Team82 from Claroty described vulnerabilities in the Danfoss AK-SM 800A controller. They made it possible, among other things, to bypass authentication and execute code remotely. Fixes were included in firmware version R4.3.1. The researchers counted about 2,765 such controllers accessible directly from the internet, including 1,590 in France. Danfoss did not confirm, however, that the attackers used these specific vulnerabilities. The exact access path has not yet been established.
At the same time, Dutch group Ahold Delhaize proactively shut down some systems in the Albert Heijn chain after detecting a security issue. The website, app and online orders, which account for about 10 percent of sales, stopped working. The disruptions also affected logistics and the websites of the group's US chains. The company says there are no grounds to link these problems with the attack in France. No source has confirmed a geopolitical motive either.
Why this affects more than just retail
The French attack did not require data theft or file encryption. It was enough to take control of device management. The same pattern threatens any company where cold storage, air conditioning and ventilation (HVAC), building automation or shop-floor machines are managed over the network. Technically, this is OT infrastructure, meaning systems that control physical processes, as opposed to office IT.
A supermarket refrigerator is no longer just an electrical appliance. It is a computerized system connected to the network, enabling remote monitoring and control
Vanunu points to the mismatch in timing. Such devices often operate for 15 years or longer, while attack methods change much faster. Kamil Sadkowski, a cyber threat analyst at ESET, draws the conclusion from both incidents that supply chain security is becoming a matter of food security. The case also has a Polish angle. Felix Aime, an analyst at Sekoia, mentions Poland among the countries where entities are dealing with the effects of attacks. For now, it is not known which Polish companies are involved.
Companies in the KSC register have to deal with this anyway
October 3 was the deadline for self-registration in the National Cybersecurity System (KSC) register. The amendment to the act implements the EU's NIS2 directive. According to the Ministry of Digital Affairs, as cited by "Rzeczpospolita", the register already contains nearly 70,500 entities. More than 8,100 registered themselves, and 62,300 were entered ex officio. Earlier estimates suggested the regulations would cover 35,000-38,000 organizations.
Industry analyses indicate that these obligations also cover controllers and industrial networks, not just servers and email. Paweł Dawidek, CEO of Fudo Security, a company focused on access control, warns against treating these months as time for writing documents. He points to access to key systems as one of the first areas to put in order, including the accounts of external service technicians and integrators. They often have permanent, broad permissions even though they log in only occasionally.
In practice, it is worth separating two questions: whether a given person may have access and whether they need it right now.
Five questions for the supplier and service technician
A company does not have to wait for the results of the French investigation to check what the situation looks like on its side. We compiled the questions below from the recommendations of the experts cited here and the Claroty team. It is worth getting the answers in writing, both from the equipment supplier and from the company that services it.
Some safeguards do not require replacing hardware. Disabling unnecessary internet connections, changing default passwords, two-factor authentication and an alert for an unusual temperature change are configuration changes you can ask the service technician to make. One case is more expensive: a device that is no longer supported by its manufacturer. In our view, the replacement of such devices should be planned in the budget before a failure forces the decision. For companies in the KSC register, this will also be useful for the risk analysis they are required to carry out anyway as part of the information security management system.