Massive Cyberattack Targets Refrigeration Systems at French Supermarkets

The global news agency, Agence France-Presse (AFP), reported that the Paris prosecutor’s office has opened an investigation into the cyberattack. 

Security Alert 

Following the cyberattack, France’s Computer Emergency Response Team (CERT-FR) issued an official security alert, confirming that several types of refrigeration control systems from Danfoss, Copeland, and Dixell were among the affected equipment. The agency added that “in general, exposing a management interface on the internet is contrary to good practices.” 

Speaking before the French National Assembly on October 13, French Economy Minister Roland Lescure said approximately 700 of the country’s 10,000 supermarket locations had been affected by the cyberattack. He said the affected stores had disconnected the refrigeration management platform and were restocking their shelves, adding that the French National Cybersecurity Agency (ANSSI) was assisting retailers in responding to the incident. 

The CERT-FR alert warns that attacks targeting the equipment may still be underway and that unpatched systems left connected to the internet face a high probability of compromise. A factory reset alone will not solve the problem because, although it may remove an existing intrusion, the equipment will remain vulnerable to another attack. 

Contractors Respond 

SNEFCCA, the French trade association representing nearly 1,300 refrigeration, commercial kitchen equipment, and air conditioning companies, said in a press release that refrigeration installers responded quickly to the cyberattack by disconnecting affected monitoring systems, helping to limit food losses. 

However, SNEFCCA raised questions about the information available to contractors before and after the attack. The association said installers reported that they had not been alerted in advance to a security vulnerability and were still waiting for an approved procedure for safely reconnecting affected equipment. 

SNEFCCA said industry professionals have consistently followed manufacturers’ security procedures and recommendations to keep refrigeration systems operational. The association called for contractors to quickly receive the technical information needed to secure affected systems and return them to service. 

The organization has contacted France’s national cybersecurity agency and government ministries about the attack and said it “hopes that the investigation will fully clarify the circumstances of this attack and any potential failures that led to the incident.” 

Manufacturer Response 

Danfoss has acknowledged the incidents and said it is working with affected customers. According to Reuters, the company said many affected controllers had reached the end of their service lives and no longer received software or security updates, while others were operating with outdated firmware. Danfoss said it has advised customers to keep supported systems updated and replace older equipment with current-generation controllers. 

The cybersecurity concerns extend beyond the affected French supermarkets. Reuters reported that an October 13 search using the internet-scanning service Shodan identified at least 4,500 Danfoss refrigeration control interfaces that were accessible through the internet. Reuters could not determine how many were running vulnerable software, but French cybersecurity company Onyphe reported that only a small minority appeared to be using the latest software versions. 

The ACHR NEWS contacted Danfoss for comment but did not receive a response by press time. 

Copeland, whose controllers were also identified in the French cybersecurity alert, said it, too, is working with affected customers. 

“We acknowledge the vulnerability identified in a discontinued, end-of-life generation of controllers,” Copeland said in a statement to The ACHR NEWS. “Protecting our customers’ operations has always been a top priority. We are currently working with impacted customers to mitigate the risk. We will continue to support customers in strengthening cybersecurity through supported products, current software and industry-recommended practices.” 

So far, no individual or group has claimed responsibility for the cyberattack, and the hackers’ motivation is “unknown at this stage,” according to CNN. 

Although the attack occurred thousands of miles away, it shouldn’t be viewed solely as a French concern, as connected refrigeration systems in U.S. supermarkets could face similar cybersecurity threats. For supermarket operators and refrigeration contractors, keeping controller firmware and software up to date, ensuring secure remote access, and replacing older controllers that no longer receive security updates can help reduce those risks (see sidebar). 

As Lescure told the French National Assembly, the attack should serve as a wake-up call for the industry.  

“A company may be perfectly prepared, but if its suppliers are not, it remains vulnerable,” he said, translated from French. “This should serve as a wake-up call to everyone: Each organization must ensure that all its partners, both upstream and downstream in its supply chain, are also taking the necessary steps to protect themselves against cyberattacks.”