Cyberattack on French supermarket refrigeration units: losses run into millions of euros
A cyberattack targeting Danfoss software caused overheating of refrigeration facilities in hundreds of French stores. Losses are estimated in the millions of euros.
Refrigerators heated to 50°C: supermarkets in Brittany and Alsace hit hard
Since the night of Sunday 12 October through Monday morning, hundreds of French supermarkets have fallen victim to a cyberattack targeting the refrigeration control systems of Danish manufacturer Danfoss, according to ouest-france.fr. Among the retailers affected are Intermarché, Netto, Coopérative U, Metro, as well as independent stores such as butchers' shops.
The attackers reportedly exploited a vulnerability in older versions of Danfoss software, prior to version 4, to hijack the automatic defrosting function of the installations. Under normal circumstances, this system is programmed to operate for approximately two hours over a 24-hour period. That night, the attackers reportedly forced continuous defrosting with the temperature set to 50 degrees Celsius, causing prolonged overheating of the equipment instead of keeping goods cold.
When refrigerators and freezers were opened in the morning, "a wave of heat escaped", according to a sector professional quoted by ouest-france.fr. In establishments where the attack began around midnight, temperatures had several hours to rise, rendering all affected products a total loss. Other stores, hit later in the night, were reportedly able to salvage some of their fresh goods.
Haguenau and Wasselone in Alsace: particularly heavy toll
In Haguenau, in Bas-Rhin, two retailers have already quantified their losses. The Intermarché store in the town reportedly lost its entire stock of frozen products, for a loss estimated at 50,000 euros. The local Leclerc store is also reportedly affected, but has not yet disclosed a figure.
In Wasselone, in the same region, the damage is even greater: a Leclerc store reportedly had to discard not only its frozen products but also its fresh products, for a loss estimated at 220,000 euros. Between them, these two Alsatian stores total 270,000 euros in losses. On a national scale, the bill could reach several million euros, according to sector sources.
300 Intermarché and Netto stores affected
The Mousquetaires group is one of the most severely hit retailers. When contacted by BFMTV, the group stated that 300 stores from its Intermarché and Netto chains were affected — a figure twice higher than initial estimates, which mentioned 150 outlets.
"Following a cyberattack that reportedly affected a provider of refrigeration system management in stores, certain fresh and frozen equipment is out of service. Intermarché and Netto have taken all necessary precautions to quickly remove products present in this equipment," the group assured BFMTV.
Internal communication from the Intermarché network, dated Monday 12 October and reviewed by ouest-france.fr, confirms the cyberattack that occurred that night at Danfoss. "Several outlets appear to be impacted by a loss of their frozen products. Our teams are mobilised and ready to prioritise your exceptional orders," the document, addressed to stores, stated.
Coopérative U also confirmed to BFMTV that "fewer than a hundred" of its stores were hit by this attack.
Crisis units and ANSSI intervention
Crisis units have been established to coordinate the response with companies specialising in refrigeration installations. A crisis meeting was scheduled for Monday at 11 o'clock between several sector service providers, including Axima, a specialist in the installation and maintenance of refrigeration equipment, and Danfoss, the supplier of the control systems targeted.
Referred to by the Prime Minister, ANSSI — the National Agency for the Security of Information Systems — has already identified a vulnerability in the software provided by the Danish company and has contacted the editor. The agency is also in contact with its European counterparts, as other countries may be affected, and is seeking to identify any other compromised systems.
Source: Google News LU FR