The key facts

  • The attack affected at least 350 supermarkets in France; the Carrefour, Monoprix, Intermarché and Coopérative U chains were hit
  • Vulnerabilities in Danfoss, Copeland and Dixell software; Reuters found at least 4,500 open Danfoss interfaces, with outdated versions 'widely represented'
  • In the Netherlands, Ahold Delhaize (Albert Heijn) began a controlled restart after an incident on Sunday; the NCSC sees no link to the French attack

Attack on refrigeration equipment in France

French investigators are searching for hackers who took control of cooling systems in at least 350 supermarkets and manually changed refrigerator temperatures, forcing staff to discard spoiled meat and frozen products. Stores of the Carrefour, Monoprix, Intermarché and Coopérative U chains, among others, were hit. The affected locations make up only a small share of France's supermarkets.

Absence of ransom puzzles the investigation

According to Reuters, citing a source familiar with the investigation, the absence of a ransom demand or claim of responsibility has left investigators baffled: criminal and hacker groups usually quickly profit from attacks or publicly claim them. Security expert Ken Munro, a partner at the British firm Pen Test Partners, suggested that 'kids messing around' could be behind the attack: 'If this were a state operation, why limit yourself to a small portion of French refrigerators? The internet is full of refrigerators in other countries too.' He called the problem a matter of 'basic digital hygiene'.

Vulnerable software and thousands of open interfaces

The French cybersecurity agency reported that the breach affected refrigerators running software from the Danish company Danfoss, as well as Copeland and Dixell systems. On Tuesday Reuters found at least 4,500 Danfoss interfaces publicly accessible, and the scanning company Onyphe noted that outdated versions 'are still widely represented among publicly available interfaces'. Danfoss stated that many affected installations 'have reached end of life and no longer receive updates' or 'are running outdated firmware'; serious vulnerabilities in older versions of its firmware were described in August by the company Claroty, and they have since been fixed. Copeland, which owns the Dixell brand, acknowledged a 'vulnerability' and said it is 'working with affected customers to mitigate risks'.

Incident in the Netherlands

In the Netherlands, Ahold Delhaize, the owner of the Albert Heijn chain, announced the start of a controlled restart of systems after a cybersecurity incident that began on Sunday. The Dutch regulator NCSC sees no connection to the attack in France. According to the TV channel NOS, Albert Heijn identified servers in the United States, Poland, Moldova and Turkey that were used in the attack; NOS emphasizes that this says nothing about the hackers' location, since traffic can easily be routed through other countries. Expert Pim Takkenberg suggested the servers were used for reconnaissance of systems or attempts at data theft.

The question of food supplies

NOS noted that the incident showed how limited food supplies are: stores and distribution centers together hold roughly a six-day supply, continuously replenished through IT systems that depend on power grids and are vulnerable to failures. In a report published last month by the Clingendael research institute and Erasmus University, residents were advised to keep an eight-day supply of food instead of three; the authors concluded that a combination of extreme weather with a major power grid and IT infrastructure accident could require up to two weeks of recovery.