Shortly before midnight last Sunday, the digital thermostats controlling hundreds of supermarket cold aisles across France began to flicker and rise. This was reported by Qazaqyia.kz citing The Guardian.
In a “bizarre and unprecedented” cyber-attack, hackers had remotely overridden the temperature settings on thousands of freezers, fridges and chiller cabinets, pushing them from as low as -27C (-16.6F) to well over 50C (122F).
Over the next four to six hours, the food inside first defrosted, then slowly began to cook.
Shop staff arriving early to restock shelves reported catching a blast of hot air, like opening an oven, when they went to fill freezers. One Normandy supermarket reported a number of its freezers had been pushed to 80C (176F). In certain stores, the extreme temperature rise had sparked fires triggering sprinklers and water damage.
“It was a catastrophe,” said one worker at the large Intermarché supermarket in the south-west suburb of Issy-les-Moulineaux in Paris. “They pushed the freezers here up to 62C. Everything had to be thrown away. It was such a waste.”
After removing tons of spoiled food, staff at the store worked until almost midnight on Monday to reorder and restock shelves. “Thankfully, we were able to get things almost back to normal the same day,” another shop worker added. “But we had to clear out everything in the freezers.”
If shop managers first assumed it was an isolated failure, it soon became clear up to 700 stores – including those from the Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix chains along with a number of smaller independent shops – had been victims of a cyber-attack.
Dominique Schelcher, the president of Coopérative U, said 80 of its 2,000 supermarkets had been targeted. “This is a completely unprecedented, unexpected, and extremely serious attack. In my entire professional career, I’ve never seen anything like it,” the shocked executive told French radio.
The Paris public prosecutor’s office immediately opened an investigation into the latest in a series of cyber-attacks that have made France the most hacked country in Europe.
Gérôme Billois, a partner in the cybersecurity and technology company Wavestone, said the hack had the hallmarks of political sabotage.
“The two most feasible scenarios are either it was a group of youngsters or activists who wanted to blow up a few freezers to prove what they could do, or it was a destabilising attack, what we call sabotage, by internal or external state actors,” he said.
“As for the attack’s signature, the most likely scenario is still a destabilisation attack – one designed to convey the message to populations that they are not safe, to convey the impression that the government is falling apart, and ultimately to instil fear.
“Currently there are two international actors known for doing this sort of thing: Iran and Russia.”
The hackers had pirated the controllers supplied by the Danish company Danfoss that controls the freezers and fridges. Most supermarket cold aisles are connected to the internet to allow remote maintenance and alerts for system failures. Initial investigations suggest the hackers disabled alarm systems before tampering with the thermostats, or extended the defrost programme by several hours to avoid triggering alarms.
Danfoss said it had identified security flaws last year and had “long recommended” that customers install updates or replace obsolete unsupported systems. The affected refrigeration units were “running outdated firmware”, it said. In the days following the first wave of attacks, France’s cyber-attack alert centre ANSSI confirmed supermarkets using controllers from two other companies were also targeted.
Marta Rybczyńska, a cybersecurity specialist and researcher, said she had found previous security warnings about old supermarket freezers running out-of-date software and newer models not having firmware updated.
“Some of these freezers hadn’t been supported by the manufacturers for several years and there were notices saying they should be replaced. Other freezers were newer but the software hadn’t been updated,” Rybczyńska said.
“The hackers found these weaknesses and used them.”
She added: “Many of the freezers appear to have been running with a default password. The hackers were able to modify or turn off the alerts so the shops only realised when the first person arrived in the morning and saw the damage that had been done.”
The most recent French cyber-attack mirrors a similar incident in the US in August when connected fridges and freezers at a dozen military commissaries – on-base food stores – went into unscheduled defrost cycles overnight causing massive food loss.
France is the most heavily pirated country in Europe by the volume of records exposed by hackers, according to the cybersecurity and risk management company Upguard.
In the last three years, hackers have breached France’s health system, France Travail, the government-run jobseekers agency, the Natio... [text truncated]