in france supermarket coolers and freezers warmed to 50 degrees following the cyberattack. While the data security of devices connected to the Internet is discussed, this incident shows the impact of remote access on physical equipment. According to the statements of companies and officials, food spoiled in many stores and fires broke out in some points. The Paris prosecutor’s office is investigating the large-scale attack.
Intermarché owner Les Mousquetaires reported that approximately 150 stores were affected. The company says some coolers reach 50 degrees for as much as six hours overnight. In addition, he states that he destroys the affected foods to eliminate the health risk. Therefore, the damage is not limited to the temporary downtime of an internet service.
Carrefour announced that 80 markets were affected by the attack. Monoprix represents 5 percent of its approximately 490 stores in France. On the other hand, Coopérative U also confirms that the attackers targeted its own stores. These figures represent information provided by companies for their own stores. Companies are not yet disclosing the exact amount of losses for the entire industry.
France’s national cyber security institution, ANSSI, is conducting an investigation into the incident. The statement from the Prime Ministry’s circle states that ANSSI has detected a vulnerability in the software provided by Danfoss. Danfoss says it is aware of incidents affecting a limited number of cooling management systems in France and that the affected units use outdated firmware.
These systems establish a different layout than the phone application of a single home refrigerator. Control panels that centrally manage the market’s cooling circuits allow the technical team to access temperature and operating settings remotely. In this way, maintenance companies can change the settings without going to every store. However, access problems at the management layer can affect more than one cooler in the same location.
Authorities review remote management with outdated firmware
Claroty Team82’s investigation dated August 9 disclosed multiple vulnerabilities in the Danfoss AK-SM 800A control platform. The team reported the findings to the manufacturer and fixed the issues described in this investigation with Danfoss R4.3.1 firmware. In addition, the researchers recommended that management interfaces not be exposed directly to the Internet.
However, the existence of a previously found vulnerability does not alone prove all the technical steps of today’s attack. Which access route the attackers used in the current incident and which systems they affected remains the subject of investigation. Danfoss’s statement about the old software should not be combined with the research findings that the manufacturer has resolved as an attack report with the same accuracy.
The importance of the event stems from the fact that information systems and operating equipment produce the same different results. A website downtime may prevent a customer from placing an order. When the setting of the cooling system is changed, physical products in the store may be damaged. Therefore, access control and software maintenance concern the operating order of the equipment as well as service continuity.
During the same period, Netherlands-based Ahold Delhaize also shut down some of its systems due to a separate network security problem. However, the company states that there is no reason to link the cooler incidents in France to its own outage. Therefore, it is not correct to present the two recent retail outages as a single attack. While some of the stores in France have returned to operation, the authorities’ scope investigation continues.