French Supermarket Cyberattack Exposes Potential Risks for U.S. Grocers
A cyberattack that disrupted refrigeration systems at hundreds of French supermarkets this week has raised concerns about the vulnerability of U.S. grocery operations to similar attacks.
French Finance Minister Roland Lescure told Parliament on Tuesday (Oct. 13) that approximately 700 of the country's 10,000 supermarkets were affected. He said the attack posed no risk to France's overall food supply.
The Paris prosecutor's office said its cybercrime unit was investigating the attack, including the extent of damage from spoiled food and reported fires. French broadcaster BFM-TV reported that hackers forced refrigeration systems into continuous defrost cycles and raised temperatures as high as 122 degrees Fahrenheit.
Dr. David Utzke, a cybersecurity expert and former U.S. Treasury federal agent who worked in the agency's cybercrimes headquarters unit, told SecurityInfoWatch the attack raises concerns about the security of remotely managed refrigeration equipment used by American grocers.
How hackers can access refrigeration controls
Commercial refrigeration systems use remotely accessible controls that allow technicians to adjust temperatures, monitor equipment and manage alarms.
France's national cybersecurity agency reported numerous compromises involving remote refrigeration control modules manufactured by Danfoss and Copeland in connection with the supermarket attacks.
In August, cybersecurity researchers at Claroty identified vulnerabilities in the Danfoss AK-SM 800A and Copeland XWeb Pro refrigeration management platforms. Both manufacturers subsequently addressed the identified flaws.
Danfoss said most affected systems in France were older products that no longer received software or security updates. The company said it was working with affected customers and had long recommended keeping supported equipment updated and operating it behind a firewall.
Utzke pointed to several of the documented vulnerabilities in the Danfoss AK-SM 800A platform, which uses a web-based interface called StoreView to coordinate refrigeration equipment.
One vulnerability involved a hardcoded authentication mechanism that could allow unauthorized access to internet-exposed control panels.
Once an attacker gained administrative access, Utzke said, another vulnerability could allow the intruder to “execute arbitrary operating system commands,” enabling remote manipulation of the equipment.
A separate flaw could disrupt the management interface and prevent store personnel from accessing digital controls.
Potential exposure for U.S. supermarkets
“U.S. grocers are highly vulnerable to the exact same type of attack,” Utzke said.
Danfoss is a major supplier of refrigeration management technology in the United States, where its systems are used in grocery operations.
Utzke also cited refrigeration outages at U.S. military commissaries in August, asserting that the same Danfoss vulnerabilities were involved.
The commissary outages prompted investigations by three U.S. military agencies, according to reporting by Stars and Stripes cited by The Associated Press. Neither the cause of those outages nor a connection to the French attack has been publicly confirmed.
Who is responsible for equipment security?
“While grocers were heavily reliant on third-party vendors like Danfoss and Copeland for the underlying software code and hardware design, they were not completely helpless,” Utzke said.
He pointed to a combination of vendor software vulnerabilities and what he characterized as inadequate security practices among grocery operators.
“Grocers had several opportunities to take independent, proactive measures,” Utzke said.
Detecting equipment tampering
Store managers and employees arriving for work Monday morning (Oct. 12) encountered hot air coming from compromised freezers and refrigerated display cases, according to Utzke.
Utzke said attackers manipulated industrial control software to suppress standard alarms or extend defrost cycles overnight, leaving monitoring systems unable to provide timely warnings.
The potential financial consequences are substantial. According to The New York Times, Dominique Schelcher, head of Coopérative U, estimated that a refrigeration failure could cost a smaller supermarket tens of thousands of dollars, with losses at a large supermarket reaching approximately $220,000.
Other infrastructure at risk
Utzke expressed concern that organizations continue operating internet-connected industrial control systems despite previously disclosed security vulnerabilities and warnings.
He identified water treatment facilities, cold-storage operations, healthcare facilities, electrical infrastructure and transportation systems as other potential targets.
“Multiple vital infrastructure sectors remain intensely vulnerable to similar cyber sabotage,” Utzke said.
About the Author
Rodney BoschRodney Bosch
Editor-in-Chief/SecurityInfoWatch.com
Rodney Bosch is the Editor-in-Chief of SecurityInfoWatch.com. He has covered the security industry since 2006 for multiple major security publications. Reach him at [email protected].