French Supermarket Cyber-Attack Widens to More Refrigeration Brands

A cyber-attack on refrigeration controllers in French supermarkets, first reported on October 11, may be larger than first thought. Many stores are still dealing with food stock disruptions. New reports suggest the incident affects temperature regulation devices from Dixell Electronics, an Italian brand owned by US heating and cooling provider Copeland, as well as Danfoss equipment. French media reported that an E. Leclerc supermarket in the Tarn region had refrigeration disruptions despite using Dixell rather than Danfoss gear.

Le Monde reported on a supermarket near Bordeaux where attackers reportedly changed freezer settings from -22°C to 150°C. A technician saw several settings altered per second, which suggests automation. France's national cyber emergency response team, CERT-FR, published an advisory on October 12 naming Danfoss AK-SC and AK-SM series, Dixell xweb and Copeland xweb as affected systems.

Amir Preminger, CTO of industrial security provider Claroty, told Infosecurity that refrigeration controllers are a prime target for supermarkets, cold-storage sites, warehouses, pharmaceutical and chemical firms, and are often overlooked by security teams. He said many such devices are directly exposed to the public internet, which makes remote maintenance cheaper but lowers the barrier for attackers. He did not consider the attack sophisticated, but said it was clearly a deliberate attempt to cause damage, as someone had to guide the campaign.