After France’s 50°C fridge hack, 4,500 Danfoss controllers are still online

Attackers took remote control of the refrigerators and freezers in at least 350 French supermarkets overnight, switched them into defrost and let them climb to as much as 50°C (122°F). At Intermarché, the fridges in about 150 stores stayed that hot for six hours, and every product inside was thrown away. The way in was the box that runs a whole store’s cold aisles: a Danfoss controller that refrigeration contractors manage over the internet.

For shoppers, that meant closed freezer aisles and staff in central Paris tipping cartfuls of thawed meat and melted ice cream into giant trash containers. For everyone else, the problem reaches well beyond France. Using the Shodan search engine, Reuters found at least 4,500 Danfoss interfaces still visible online after the attack, and the French scanning company Onyphe said only a small minority appeared to run the latest software.

Carrefour counted 80 affected supermarkets and Monoprix about 5% of its roughly 490 French stores. Coopérative U was also hit, although its chief executive, Dominique Schelcher, said the cold chain held in most of its affected shops because staff and contractors reacted quickly. E.Leclerc said one of its refrigeration suppliers had been attacked. The Paris prosecutor’s office reported food losses and equipment that began to catch fire, and Thierry Cotillard, who heads Intermarché’s parent Les Mousquetaires, told BFMTV the damage would run to “tens of millions of euros nationwide in a single day”.

Danfoss says many of the units hit had “reached end of life and no longer receive software or security updates”, while others were “running outdated firmware”. It named two older models, the AK-SM 800 and the AK-SC 355, both retired years ago, and some of its current AK-SM 800A controllers on old firmware were caught too. France’s national cybersecurity agency, ANSSI, has also named software from Copeland and its Dixell brand among the systems affected. Copeland acknowledged the “vulnerability” and said: “We are currently working with impacted customers to mitigate the risk.”

Supermarket refrigeration sits online for a mundane reason. A contractor can adjust temperatures, clear alarms and change defrost cycles without driving to the store. CERT-FR, the government’s emergency response team, has told every operator of Danfoss AK-SM and AK-SC controllers to disconnect them or tightly filter who can reach them, and ANSSI’s director, Vincent Strubel, called that step urgent, according to AFP.

What nobody can say yet is how the attackers got in, or why. No group has claimed the attack and no ransom has been demanded, which has puzzled investigators, according to a source quoted by Reuters. CERT-FR has named no vulnerability, firmware version or sign of compromise for operators to check, and the flaws that the security firm Claroty documented in the AK-SM 800A have not been linked to the attack. Owners of the oldest models have no patch to install at all, so the real fix is new hardware, bought through the same contractors who installed the old boxes. “This is about basic cyber hygiene,” said Ken Munro of Pen Test Partners. “Get it wrong and you get a smelly mess of defrosted food.” He added that the attackers were pushing at an open door and that the culprits could easily be “kids messing around”.

France may not be alone. Félix Aimé, a threat intelligence analyst at Sekoia, told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected, without giving details, and ANSSI is in contact with agencies elsewhere in Europe. A separate incident took the Dutch retailer Ahold Delhaize’s online grocery services offline at the same time, but the Dutch cybersecurity centre NCSC sees no link. There are precedents: fridges at about a dozen US military commissaries were disrupted in a similar way in late August, and Danfoss’s own customer newsletter records attacks on 16 Russian supermarkets and 40 Israeli stores in 2022.

The attack started on the night of Sunday, October 11, and CERT-FR published its alert the next day. Danfoss declared the AK-SM 800 end-of-life in May 2021 and phased out the AK-SC 355 in 2016, while Claroty published its research on the newer model on August 9. The Paris prosecutor’s cybercrime section has opened an inquiry, run by the anti-cybercrime office OFAC, to count the victims and tie each loss to the attack, and the French retail federation FCD has asked Danfoss for “full transparency”. Until the investigators find the way in, the cheapest fix on CERT-FR’s list needs no patch: take the controller off the internet.

Tags: Pelé, Cher, IoT security, cyberattack, ANSSI, Carrefour