Hackers heat fridges in 700 French supermarkets to 50 °C

Around 700 French supermarkets came under cyberattack overnight into Monday: hackers remotely raised the temperature in refrigerators and freezers to 50 degrees Celsius. France’s food supply was never at risk, but the attack showed how easily food stocks can be spoiled and how much damage retail chains can suffer.

Who was hit and how big the losses are

“This reminder should be a wake-up call for everyone,” Finance Minister Roland Lescure warned in the French parliament on Tuesday. In his words, the blow struck at the very core of the country’s food sovereignty. Who is behind the attack and what their motives are remains unknown.

The attack hit about 300 Intermarché and Netto stores operated by the French group Groupement Les Mousquetaires, 80 Cooperative U stores, 80 Carrefour stores and roughly 30 Monoprix stores. The E.Leclerc and Metro chains were also attacked, but they did not specify how many stores were affected. At Intermarché alone, initial estimates put the damage at tens of millions of euros; the other companies have not published estimates, but across all the chains combined it could exceed a billion crowns.

The story has a Czech angle as well. Monoprix belongs to the Casino group, which is controlled by billionaire Daniel Křetínský. Through his equity stake he also controls Metro, which includes the Czech Makro. Makro referred journalists’ questions to its international headquarters, which had not replied by the time of publication.

How the hackers got into the systems

Investigators have not yet revealed exactly how the attackers broke into the systems. The French cyber incident response team CERT-FR confirmed that the refrigeration control systems of Danfoss and Copeland were attacked: for Danfoss the AK-SM and AK-SC series, for Copeland the XWEB system, which the company also sells under the Dixell brand.

According to the Danish manufacturer Danfoss, the hackers affected mainly older devices for which the company no longer issues security updates. But they also reached newer AK-SM 800A units running unpatched software. The manufacturer therefore advised customers to update their software, replace outdated devices and protect their systems from direct access from the internet. Copeland also acknowledged a vulnerability in older units that it no longer produces or supports. Both companies said they are helping affected customers secure their systems.

Are such systems used in Czechia?

Remote control systems for refrigeration equipment from these companies are used in Czechia too. Dixell XWEB is sold, for example, by the company Logitron. Its director Lubomír Andrejsek stresses that the firm does not develop the technology but sells and configures it for clients: “We only sell it.” He does not know the details of the French case, but sees a possible weak point in how the devices are connected to the network. For older units, he says, the supplier must provide additional protection against access by outsiders. The director declined to say which customers in Czechia the company supplies with these systems.

Retail chains are tight-lipped and, for security reasons, did not want to name the systems they use. Lidl said the incident did not affect it in any way but gave no details. Billa, according to spokeswoman Dana Bratánková, knows of no similar cases across the whole REWE group and is monitoring the situation. Globus also recorded no such attempted attack; it did not disclose specific technologies or its supplier, but described some protective measures. “External partners’ access to our systems is protected on multiple levels, including two-factor authentication,” said spokesman Zdeněk Vesecký.

The attackers may not have had to overcome any complicated obstacles. Three security experts pointed to unpatched software and systems accessible directly from the internet. According to Ken Munro of Pen Test Partners, the hackers, figuratively speaking, found an open door. “These are the basics of cyber hygiene,” he said.

How quickly known vulnerabilities can be exploited was shown by an experiment by Claroty, a company that tests systems’ resilience to cyber threats. Using artificial intelligence, its researchers gained full control of a lab Danfoss AK-SM 800A unit in just 28 minutes, although the AI needed expert guidance. Whether the French attackers used the same flaws has not yet been confirmed.

Around Prague, based on reporting by seznamzpravy.cz