Hackers Overheat Fridges at Hundreds of French Supermarkets, Forcing Stores to Bin Stock

Attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11, warming them and forcing stores to discard food, several retail chains said. They got in through the controller that runs a store's refrigeration, a device made by Danish company Danfoss that maintenance firms can manage remotely. Les Mousquetaires, which owns Intermarché, said its units were put into defrost and heated to as much as 50°C.

CERT-FR, the French government's computer emergency response team, said on October 12 that it knew of numerous compromises affecting two Danfoss controller series, the AK-SM and the AK-SC. It told operators to disconnect the controllers or filter access to them. ANSSI head Vincent Strubel called it urgent to take the two series off the internet or restrict access very tightly. Danfoss said most of the units hit were older models that no longer receive software or security updates, naming the AK-SM 800 and AK-SC 355. Neither the authorities nor Danfoss has said who was behind the attack or how the controllers were breached.

Impact varied. Coopérative U said the cold chain held in most of its 80 affected stores, with only a minority losing goods. Intermarché said its affected stores had to throw away all the products concerned. Les Mousquetaires head Thierry Cotillard expected losses of tens of millions of euros across France. Danfoss said it was aware of incidents affecting a limited number of systems. This account is based on the opening of the original report.