Hackers overheated refrigeration units in hundreds of French supermarkets

The attackers took over remote cooling controllers and raised the temperature to 50°C. Controllers of this type also operate in warehouses and cold storage facilities, and the effects of the attacks were also recorded in other European countries, including Poland.

On the night of October 11 to 12, cybercriminals took control of cold rooms and freezers in French supermarkets. According to Reuters and AFP, the temperature rose to 50°C and remained there for about six hours. Stores had to dispose of food, and fires broke out at some sites.

Elevated temperatures were recorded in around 150 Intermarché stores. In total, the attack affected at least 300 Intermarché and Netto outlets, more than 100 Coopérative U stores, 80 Carrefour supermarkets, and 5 percent of Monoprix stores. E.Leclerc stores also experienced problems, but that chain and Auchan did not issue statements. Intermarché CEO Thierry Cotillard told BFM TV that the sector's losses amounted to tens of millions of euros in a single day.

The attack affected AK-SM and AK-SC series controllers made by the Danish company Danfoss. CERT-FR, the French computer incident response team operating under the ANSSI cybersecurity agency, issued an alert on October 12 about numerous takeovers of these devices. Danfoss says they were running outdated firmware, and some were discontinued models without security updates. In August, Team82 researchers from Claroty described vulnerabilities in the AK-SM 800A controller, after which the manufacturer released a patch. It has not been confirmed that those specific vulnerabilities were used in the attack. ANSSI chief Vincent Strubel called the incidents sabotage and stressed that nothing has been established at this stage. The Paris prosecutor's office has opened an investigation.

According to Felix Aime of Sekoia, entities in Poland, Spain, Portugal, Germany, and Belgium are also dealing with the effects of the attacks. At the same time, the Dutch company Ahold Delhaize shut down part of the systems of the Albert Heijn chain after a security incident. The group says there is no basis for linking the two events.

CERT-FR recommends disconnecting management interfaces from the public internet, allowing access only via VPN (an encrypted connection to the company's network) or from permitted IP addresses, updating firmware, and checking the configuration. Cybersecurity experts recommend similar protection for all network-connected operational infrastructure devices (OT, meaning equipment that handles physical processes): cold rooms, building automation, or warehouses.