French supermarket chains are dealing with the aftermath of a cyberattack that targeted the refrigeration systems inside hundreds of their stores. Carrefour said about 80 of its locations were affected, in addition to more than 300 stores at Intermarché and Netto, while Coopérative U reported fewer than 100 affected stores. Intermarché's own count put the number as high as 200 stores.
According to reporting on the incident, the attackers reportedly gained access to industrial refrigeration controllers made by Danfoss, a Danish company whose equipment is widely used to manage cooling systems in commercial refrigeration across Europe. The intrusion reportedly forced some units to defrost at temperatures up to 50 degrees Celsius, well beyond normal operating ranges, and fires broke out at some stores as a result. Paris prosecutors have opened a criminal investigation into the incident.
France's national cybersecurity agency, known as ANSSI, identified a flaw in the Danfoss software that investigators believe was exploited to carry out the attack, according to an aide to the French prime minister. Because similar refrigeration control systems are used by retailers well beyond France, officials there have said they are concerned the vulnerability could affect supermarket chains and other commercial refrigeration users in other European Union countries.
The episode is a reminder of how much everyday retail and food-supply infrastructure now depends on networked industrial control systems, the same category of equipment that manages heating, cooling and other building functions in warehouses, hospitals and factories. Attacks on these systems are harder for the public to notice than attacks on websites or payment systems, but they can have immediate physical consequences, in this case spoiled food, store closures and in some locations fires.
Watch for whether other EU retailers using Danfoss refrigeration controllers report similar intrusions, and for the findings of the Paris prosecutors' investigation into who was responsible.
What equipment was targeted?
Industrial refrigeration controllers made by Danfoss, which manage cooling systems in commercial refrigeration units used across many French supermarket chains.
Could this spread beyond France?
French officials have said they are concerned the underlying software flaw could affect retailers in other EU countries that use the same Danfoss control systems.