A sophisticated cyberattack targeting critical industrial control systems has disrupted refrigeration units at hundreds of supermarkets across France this week, leading to significant food spoilage and raising urgent alarms about the security of the retail supply chain. The incident, which has prompted a formal investigation by the Paris prosecutor\u2019s office, has affected equipment manufactured by major industry players Danfoss and Copeland, including the latter’s Dixell brand.<\/p>\n
France\u2019s national cybersecurity agency, ANSSI, issued its first alert on October 12 via its computer emergency response team, CERT-FR. The warning initially centered on the compromise of Danfoss AK-SM and AK-SC series refrigeration controllers. However, as the scope of the incident became clearer, the agency expanded its advisory on October 13 to include Copeland XWEB and Dixell XWEB systems. The sheer scale of the disruption has forced French authorities to confront a new reality where essential infrastructure\u2014often operating quietly in the background of daily commerce\u2014has become a prime target for digital sabotage.<\/p>\n
The impact of the attack has been severe, particularly for the cold chain that keeps perishable goods safe for human consumption. While initial reports suggested that between 300 and 350 stores were affected, the situation proved to be significantly more widespread. On Tuesday, French Finance Minister Roland Lescure addressed lawmakers, confirming that approximately 700 of the country\u2019s roughly 10,000 supermarkets had been impacted by the unauthorized access.<\/p>\n
Prominent supermarket chains, including Carrefour, Coop\u00e9rative U, E.Leclerc, Intermarch\u00e9, and Monoprix, have confirmed that their systems were targeted. The operational fallout was immediate and costly. At Intermarch\u00e9, owner Les Mousquetaires reported that 150 of its stores experienced critical malfunctions. In these instances, the refrigeration units were manipulated to run at 50 degrees Celsius for six hours\u2014a catastrophic deviation that rendered all stored food unsafe, forcing the stores to discard their entire inventory.<\/p>\n
Other retailers reported similar difficulties. Coop\u00e9rative U CEO Dominique Schelcher noted that 80 of the group\u2019s stores were hit by the digital intrusion. While he stated that only a minority of those locations suffered total product loss, the financial impact remains substantial. Two supermarkets in the Alsace region alone reported combined losses totaling \u20ac270,000, or approximately $300,000. <\/p>\n
Beyond the immediate financial burden, the attack introduced physical hazards. The Paris prosecutor\u2019s office, which has mobilized its cybercrime division to lead an investigation, indicated that the manipulation of the controllers led to fires in some locations. According to reports from Le Monde<\/em>, the attackers executed a specific tactic of lengthening the defrost cycles of the refrigeration units from the standard one hour to as many as eight hours. By doing so, they effectively masked the rise in temperature, delaying the triggering of alarms that would have alerted store staff to the malfunction before the food reached the danger zone.<\/p>\n The role of equipment manufacturers in this crisis has become a focal point of the investigation. Copeland, whose systems were explicitly named in the updated ANSSI alert, initially declined to confirm the findings of the national agency. However, the company later acknowledged the presence of vulnerabilities within its systems. "We are currently working with impacted customers to mitigate the risk," the company stated in a brief press release.<\/p>\n The technical context behind the attack points to long-standing security concerns. Earlier this summer, the research firm Claroty published findings detailing significant flaws in Danfoss\u2019s AK-SM 800A controllers, as well as 23 separate vulnerabilities identified in Copeland\u2019s XWEB Pro controller series. While Copeland did release firmware updates to patch these vulnerabilities, the current incident highlights the perilous gap between the availability of a security update and its actual implementation in the field.<\/p>\n Danfoss has provided further context regarding the susceptibility of their systems, noting that the vast majority of the compromised devices are older models that have reached their "end of life." Specifically, the company pointed to the AK-SM 800 and AK-SC 355 systems. The AK-SM 800 was discontinued and support ceased in May 2021, while the AK-SC 355 has been unsupported since 2016. Because these devices no longer receive security patches, they represent a permanent, unfixable security risk if left connected to the public internet. Some newer, current-generation AK-SM 800A controllers were also affected, though Danfoss noted that these were specifically those running outdated firmware.<\/p>\n In response to the mounting crisis, CERT-FR has issued urgent guidance to operators of these refrigeration controllers. The agency is calling for an immediate "offline" approach: all affected controllers should be disconnected from the internet. If remote access is required for business operations, the agency mandates that it be facilitated exclusively through a secure VPN or a protected, isolated network. The practice of filtering connections by specific IP addresses\u2014a common, low-effort security measure\u2014was explicitly dismissed by the agency as insufficient for anything beyond a temporary emergency measure.<\/p>\n Perhaps most importantly, the agency warned against a false sense of security regarding compromised hardware. For the older, end-of-life devices, performing a factory reset is not a viable long-term solution. Because the underlying vulnerabilities remain unpatched, a factory-reset device will likely be re-compromised almost immediately if it remains exposed to the public web.<\/p>\n The lack of an obvious motive has left both investigators and the cybersecurity community baffled. As of the latest updates, there has been no claim of responsibility and, notably, no ransom demand. This absence of a clear criminal objective has fueled speculation about the nature of the actors involved. While the attack has primarily hit France, reports from Sekoia analyst F\u00e9lix Aim\u00e9 indicate that the disruption may have reached stores in Spain, Portugal, Poland, Germany, and Belgium, though specific details remain sparse. Meanwhile, the Dutch NCSC has clarified that they do not believe a recent cyberattack against Ahold Delhaize is linked to the broader refrigerator-targeting campaign.<\/p>\n Data from the internet-scanning firm Censys provides a grim visualization of the scope. On October 11, the firm identified nearly 3,000 internet-exposed Danfoss StoreView control panels, with more than 1,800 of them located in France. By October 14, following the initial warnings, the number of exposed units in France dropped to 537. Significantly, Censys noted that both patched and unpatched versions of the software were disappearing from public view at roughly the same rate. This suggests that retail operators are choosing to simply disconnect the controllers to mitigate risk rather than undergoing the more intensive process of updating the firmware or hardening the systems.<\/p>\n The incident has also triggered a tense debate over corporate accountability. As retailers count their losses\u2014which include not only the cost of the spoiled food but also the expense of restocking and repairing damaged machinery\u2014questions regarding who is responsible for the security of these systems are coming to the forefront. According to Bloomberg<\/em>, the owners of Intermarch\u00e9 have signaled that because the refrigeration systems were managed by Danfoss, the burden of filing a formal complaint and addressing the security failure should lie with the supplier.<\/p>\n As the investigation continues, the French retail sector remains on high alert. The incident serves as a stark reminder of the convergence between digital security and physical reality. In a modern supermarket, the line between an IT network and the hardware responsible for preserving the food supply is increasingly thin, and the consequences of leaving that line unprotected are proving to be both expensive and disruptive. Authorities remain focused on identifying the perpetrators and ensuring that the remaining vulnerable systems across Europe are secured before further damage occurs.<\/p>\n","protected":false},"excerpt":{"rendered":" A sophisticated cyberattack targeting critical industrial control systems has disrupted refrigeration units at hundreds of supermarkets across France this week, leading to significant food spoilage and raising urgent alarms about the security of the retail supply chain. The incident, which has prompted a formal investigation by the Paris prosecutor\u2019s office, has affected equipment manufactured by<\/p>\n","protected":false},"author":19,"featured_media":1673,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[373],"tags":[302,374,1608,872,1045,144,1610,1609,5,1449,812,202,1192],"class_list":["post-1674","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bug-bounty-vulnerabilities","tag-across","tag-bug-bounty","tag-cripples","tag-cyberattack","tag-french","tag-hacking","tag-hundreds","tag-refrigeration","tag-security","tag-supermarkets","tag-systems","tag-vulnerabilities","tag-widespread"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/1674","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1674"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/1674\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/1673"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1674"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1674"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1674"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Vendors and Vulnerabilities Under Scrutiny<\/h3>\n
Remediation and Industry Reaction<\/h3>\n
A Complex Landscape of Liability<\/h3>\n