Hackers Raise Freezer Temperatures at Up to 700 French Supermarkets

Shortly before midnight, the thermostats controlling hundreds of cold aisles began to flicker and rise. Over the next four to six hours, food inside first defrosted and then slowly began to cook. Staff arriving early to restock shelves reported a blast of hot air, like opening an oven. One Normandy supermarket reported some freezers had been pushed to 80C (176F). In some stores, the temperature rise sparked fires that triggered sprinklers and caused water damage.

'It was a catastrophe,' said one worker at the large Intermarché supermarket in Issy-les-Moulineaux, south-west of Paris. 'They pushed the freezers here up to 62C. Everything had to be thrown away. It was such a waste.' Staff worked until almost midnight on Monday to reorder and restock shelves after removing tons of spoiled food. Another worker said the store had been able to get things almost back to normal the same day but had to clear out everything in the freezers.

The scope soon became clear. Up to 700 stores, including those from Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix as well as smaller independent shops, had been hit. Dominique Schelcher, president of Coopérative U, said 80 of its 2,000 supermarkets had been targeted. 'This is a completely unprecedented, unexpected, and extremely serious attack. In my entire professional career, I've never seen anything like it,' he told French radio. The Paris public prosecutor's office opened an investigation into the latest in a series of cyber-attacks that have made France the most hacked country in Europe.

Gérôme Billois, a partner at cybersecurity and technology company Wavestone, said the hack had the hallmarks of political sabotage. 'The two most feasible scenarios are either it was a group of youngsters or activists who wanted to blow up a few freezers to prove what they could do, or it was a destabilising attack, what we call sabotage, by internal or external state actors,' he said. He said the most likely scenario was a destabilisation attack designed to convey that populations are not safe, that the government is falling apart and ultimately to instil fear. 'Currently there are two international actors known for doing this sort of thing: Iran and Russia,' he said.

The hackers pirated controllers supplied by Danish company Danfoss that control the freezers and fridges. Most supermarket cold aisles are connected to the internet to allow remote maintenance and alerts for system failures. Initial investigations suggest the hackers disabled alarm systems before tampering with thermostats, or extended the defrost programme by several hours to avoid triggering alarms. Danfoss said it had identified security flaws last year and had 'long recommended' that customers install updates or replace obsolete unsupported systems. The affected refrigeration units were 'running outdated firmware', it said. France's cyber-attack alert centre ANSSI confirmed supermarkets using controllers from two other companies were also targeted.

Marta Rybczyńska, a cybersecurity specialist and researcher, said she had found previous security warnings about old supermarket freezers running out-of-date software and newer models not having firmware updated. 'Some of these freezers hadn't been supported by the manufacturers for several years and there were notices saying they should be replaced. Other freezers were newer but the software hadn't been updated,' she said. 'The hackers found these weaknesses and used them.' She added that many freezers appeared to have been running with a default password, and that hackers were able to modify or turn off alerts so shops only realised when the first person arrived in the morning and saw the damage.

The French attack mirrors a similar incident in the US in August, when connected fridges and freezers at a dozen military commissaries, or on-base food stores, went into unscheduled defrost cycles overnight and caused massive food loss. According to cybersecurity and risk management company Upguard, France is the most heavily pirated country in Europe by the volume of records exposed by hackers.