Hackers Heat French Supermarket Fridges to 50C, Sparking Fires and Food Spoilage
Hackers remotely raised temperatures in connected refrigeration systems at hundreds of French supermarkets, spoiling food and sparking fires, according to Slashdot. French Prime Minister Sebastien Lecornu ordered a cybersecurity investigation, and similar incidents were reported in five other European countries.
Slashdot, citing Reuters, reported that similar incidents were also recorded in Spain, Portugal, Poland, Germany and Belgium. In France, Carrefour reported 80 affected stores. Monoprix said 5% of its locations were hit. Les Mousquetaires said refrigerators at roughly 150 Intermarche stores were heated to 50C for six hours.
Supermarket cold aisles are typically run by control panels that manage an entire store's fridges and freezers and can be accessed over the internet, which lets maintenance companies adjust them from anywhere, according to the report.
A source close to Lecornu said ANSSI had identified a vulnerability in software supplied by Danish company Danfoss. Danfoss said it was "aware of incidents in France affecting a limited number of refrigeration management systems." The affected units "were running outdated firmware," Danfoss said, adding that it had "long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions."
On August 9, cybersecurity firm Claroty's Team82 published research detailing vulnerabilities in the Danfoss AK-SM 800A controller. According to the report, software updates issued by Danfoss addressed issues that could have allowed attackers to bypass authentication controls and execute code on compromised devices.
The hacks affected multiple French retail chains and refrigeration systems associated with Danfoss software, according to the accounts. The investigation ordered by Lecornu is examining the incidents, while Danfoss has pointed to outdated firmware on the affected units.
Editor's Summary Hackers remotely manipulated internet-connected refrigeration systems at hundreds of French supermarkets, pushing temperatures to 50C, spoiling food and sparking fires, with similar incidents reported in Spain, Portugal, Poland, Germany and Belgium. French Prime Minister Sebastien Lecornu ordered a cybersecurity investigation, and a source said ANSSI identified a vulnerability in software from Danish company Danfoss. Danfoss said affected units ran outdated firmware, while Claroty's Team82 had previously published research on vulnerabilities in its AK-SM 800A controller.