- Attackers heated fridges at several hundred French supermarkets, iTnews reports. The Paris prosecutor described a large-scale attack that caused food losses and fires.
- Danfoss says the affected units ran outdated firmware. A source in the prime minister's office says France's cyber agency found a Danfoss vulnerability. The entry route is not public.
- Ask who owns firmware updates for connected building equipment, and which of those controllers can be reached from the internet.
A supermarket fridge is meant to be dull. It holds one number steady, and nobody thinks about it. This week in France, that number was pushed up to 50 degrees Celsius. The lesson goes beyond fridges. Equipment that looks like furniture can sit on the internet. The business that bears the loss may not be the one that maintains the equipment.
What happened
iTnews reports that hackers forced fridge and freezer temperatures up to 50°C at several hundred French supermarkets. The result was fires and spoiled food.
The Paris prosecutor's office called it a "large-scale" attack on connected refrigerators at several major food retailers. The prosecutor's office said it led to food losses and fires.
The retailers gave their own numbers. Carrefour said 80 of its supermarkets were hit. Monoprix reported that one in twenty of its stores was affected. Les Mousquetaires, which owns Intermarche, said about 150 stores ran hot for six hours overnight. It threw out all the affected food.
Why a fridge was reachable
A store usually has one control panel for all its fridges and freezers. iTnews says these panels can be reached over the internet. Maintenance firms use that link to change settings without a site visit.
The convenience is real. So is the exposure. A door built for a technician is a door that others can test.
What is known about the entry route
The sources do not name the flaw that was used. They do not say how the attackers got in. That part is not public.
A person in the prime minister's office pointed to Danfoss, a Danish supplier of the software. According to that person, France's cyber agency, ANSSI, found a vulnerability there.
Danfoss said it knew of incidents affecting "a limited number of refrigeration management systems". It said the affected units "were running outdated firmware". Firmware is the built-in software that runs a device.
In August, Claroty's Team82 research group published a report on Danfoss's AK-SM 800A controller. Per that report, Danfoss updates fixed flaws that could let an attacker skip the login and run code on the device. iTnews does not say whether those flaws were used in France. Treat that link as unconfirmed.
Two ways of counting
Danfoss speaks of a limited number of systems. Retailers speak of hundreds of stores. Both can be true, because one panel can run a whole store.
The gap matters to buyers. A vendor counts units. A retailer counts stores, stock and fires.
Danfoss also said it had "long advised" customers to keep systems updated and to move off legacy ones. That puts the duty on the buyer. Yet a store manager rarely sees the panel. A contractor often does. The risk sits with the retailer, but the knowledge sits with a third party.
What this shows
This incident shows that remote maintenance access is a risk decision, not only a convenience. Each panel that lets a technician help from afar is also a panel that someone else can try to reach. In France, the entry route is still unknown. The exposure was there anyway.
The effects may reach beyond France. Felix Aime, an analyst at Sekoia, said Spain, Portugal, Poland, Germany and Belgium were also affected. iTnews notes an earlier case that looks similar. About a dozen US military commissaries reported fridge disruptions in late August, and food was lost. France is working with European counterparts.
Dominique Schelcher, chief executive of Cooperative U, called an attack on food preservation equipment "unprecedented". No one has yet estimated industry-wide losses.
Questions for your team
Start with an inventory. Which connected devices in your stores, warehouses or offices control temperature, power or access? Who owns each one? Which firmware version does it run?
Then ask about reach. Can any of those controllers be reached from the open internet? If a contractor needs remote access, can it run through a private connection with strong sign-in?
Finally, ask about contracts. Does your maintenance agreement make someone responsible for firmware updates? Who tells you when a vendor publishes a fix? And how long could you trade if a store's cold chain failed overnight?
A fridge that can be set to 50°C from afar is not a kitchen appliance. It is a networked system, and it needs an owner.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: iTnews.
