French supermarket fridge hack: hackers pushed hundreds of cold aisles to cooking temperatures
Hackers remotely overrode digital thermostats at up to 700 French supermarkets last Sunday night, pushing freezers from as low as -27C to well over 50C and forcing staff to bin tons of food. The Paris public prosecutor's office has opened an investigation.
French supermarket fridge hack: hackers pushed hundreds of cold aisles to cooking temperatures
Overnight sabotage in the cold aisles
Shortly before midnight last Sunday, the digital thermostats controlling hundreds of supermarket cold aisles across France began to flicker and rise. Hackers had remotely overridden the temperature settings on thousands of freezers, fridges and chiller cabinets, pushing them from as low as -27C to well over 50C.
Over the following four to six hours, the food inside first defrosted, then slowly began to cook. In one Normandy store a number of freezers were pushed to 80C, and in certain stores the temperature rise sparked fires, setting off sprinklers and causing water damage.
Early-shift staff got the first sign of trouble when they went to fill the freezers and were met with a blast of hot air, like opening an oven.
Tonnes of food thrown away
At the Intermarché supermarket in Issy-les-Moulineaux, a south-west Paris suburb, freezers were pushed to 62C. A worker at the store said everything had to be discarded.
They pushed the freezers here up to 62C. Everything had to be thrown away. It was such a waste.
The same worker called the incident a catastrophe. A colleague said the shop had been able to get things almost back to normal the same day, but everything in the freezers still had to be cleared out. Staff removed tons of spoiled food and worked until almost midnight on Monday to reorder and restock the shelves.
Which chains were hit
Up to 700 stores were affected, among them outlets from several of France's biggest supermarket chains as well as smaller independent shops:
- Intermarché
- Coopérative U
- Carrefour
- Leclerc
- Monoprix
At Coopérative U, president Dominique Schelcher said 80 of its 2,000 supermarkets had been targeted, and blamed unnamed refrigeration contractors who maintain the cold aisle equipment. "Our supermarkets are not customers of Danfoss," he said.
This is a completely unprecedented, unexpected, and extremely serious attack. In my entire professional career, I've never seen anything like it
How the hackers got in
The hackers pirated controllers supplied by the Danish company Danfoss. Most supermarket cold aisles are connected to the internet for remote maintenance and failure alerts. Days after the first wave, France's cyber-attack alert centre ANSSI confirmed that supermarkets using controllers from two other companies had also been targeted.
According to initial investigations, the hackers either disabled alarm systems before tampering with the thermostats, or extended the defrost programme by several hours so no alarm was triggered.
Danfoss said it identified security flaws last year and had long recommended updating or replacing obsolete systems; the affected refrigeration units were running outdated firmware. Cybersecurity researcher Marta Rybczyńska said she found earlier warnings about old freezers running out-of-date software and newer models lacking firmware updates. "Some of these freezers hadn't been supported by the manufacturers for several years," she said.
She added that many of the freezers appear to have been running with a default password, which would have let hackers modify or switch off alerts so that shops only realised what had happened in the morning.
Who is behind it and what happens next
No individual or group has claimed responsibility. Paris prosecutors have instructed detectives from the prosecutor's office anti-cybercrime unit to investigate.
Gérôme Billois, a partner at Wavestone, said the two most feasible scenarios were either a group of youngsters or activists proving a point, or a destabilising attack of the kind he called sabotage. In his view the attack's signature most likely pointed to destabilisation meant to make populations feel unsafe and instil fear. "Currently there are two international actors known for doing this sort of thing: Iran and Russia," he said.
Rybczyńska said tracing the hackers depends on their capability: youngsters are easier to find, professionals take longer, and a foreign country would make it extremely difficult. Billois said it could take weeks if not months to be certain, because hackers know how to hide their tracks.
