Key facts
- Over 350 French supermarkets were affected by cyberattacks that overrode fridge temperatures.
- Spoiled meat and frozen food had to be discarded due to the attacks.
- The affected fridges ran software from Danfoss, Copeland, and Dixell.
- Thousands of similarly exposed devices remain online.
- A separate cyber incident is disrupting Dutch grocer Albert Heijn.
- No group has claimed responsibility for the French supermarket attacks.
Thousands of supermarket refrigeration units in France were compromised by cyberattacks over the weekend, leading to significant food spoilage and prompting investigations into the perpetrators. At least 350 stores, including major chains like Carrefour, Monoprix, Intermarché, and Coopérative U, had their fridge temperatures manually overridden by attackers.
The lack of a ransom demand or claim of responsibility has puzzled investigators, according to a source with knowledge of the probe cited by Reuters. Experts warn that thousands of similar devices, particularly those running outdated firmware from companies like Danfoss, Copeland, and Dixell, remain exposed online.
France's cybersecurity agency confirmed the breach affected fridges using software from Danish firm Danfoss, as well as Copeland and Dixell systems. Security firm Claroty had previously detailed serious flaws in older Danfoss firmware in August, which have since been patched. Copeland acknowledged the vulnerability and is working with affected customers.
Ken Munro, a partner at British firm Pen Test Partners, suggested the attack might be the work of "kids messing around" due to its limited scope and lack of clear motive, rather than a sophisticated state-sponsored operation.
Separately, Dutch grocer Albert Heijn began a controlled restart of its systems following a cybersecurity incident that started on Sunday. The Dutch cybersecurity watchdog NCSC stated there was no link to the French attacks. Servers in the US, Poland, Moldova, and Turkey were identified as being used in the Albert Heijn incident, though this does not pinpoint the hackers' location.