A worker restocking products in a refrigerated section of a supermarket two days after the cyberattack on several French supermarkets in Montreuil, France (AP photo)
The agency said on Tuesday night that the attacks were “likely still underway” and urged retailers to reconnect refrigeration systems to the internet only through secure virtual private network (VPN) connections or protected networks. It also advised stores to install firmware updates and change passwords, according to the news agency Associated Press (AP). French finance minister Roland Lescure said around 700 of the country’s 10,000 supermarkets had been affected, describing the incident as a “wake-up call for everyone”. France’s cybersecurity agency said it was aware of numerous compromises involving remote-control modules used in refrigeration systems manufactured by Danish company Danfoss and US-based Copeland . Danfoss said many of the affected systems were older products that no longer received software or security updates. Copeland said a vulnerability had been identified in “a discontinued, end-of-life generation of controllers” and that it was working with affected customers. Claroty said some Danfoss controllers were directly accessible through the public internet, potentially exposing them to attacks. “This is about basic cyber hygiene,” he said. “Get it wrong and you get a smelly mess of defrosted food.”
A report published in August by US cybersecurity firm Claroty identified vulnerabilities in the Danfoss AK-SM 800A and Copeland XWeb Pro platforms, which are used to manage refrigeration infrastructure in supermarkets, warehouses and other facilities. The vulnerabilities identified in the report have since been fixed.
The French government has said the attack did not threaten the country’s overall food supplies, although Lescure acknowledged that it “touches the heart of our food security”.