Hackers remotely took control of supermarket refrigeration systems across France, causing freezers to heat up, destroying food and reportedly starting fires. The attack raises serious questions about how vulnerable America’s own food supply is to cyberattacks.
Hackers managed to do something this weekend that should concern anyone who depends on a grocery store to feed their family. They remotely accessed refrigeration systems at hundreds of French supermarkets, forced the equipment into continuous defrost cycles, and reportedly pushed temperature settings as high as 122°F. By Monday morning, October 12, stores were dealing with ruined meat, dairy products, frozen food and, in some locations, reports of fires.
According to AFP, between 150 and 200 Intermarché supermarkets and nearly 100 Coopérative U locations were targeted. Other chains, including E.Leclerc, were also reportedly affected. French authorities have opened an investigation, and the full extent of the damage is still being determined.
The hackers reportedly exploited older refrigeration-control software from Danish manufacturer Danfoss. Rather than shutting the equipment off, they manipulated its defrost function, which normally runs for short periods to prevent ice buildup. The systems were instead forced to keep heating.
In Haguenau, a town in northeastern France, local supermarkets reportedly suffered hundreds of thousands of dollars in spoiled inventory. Across the country, losses could reach millions.
This wasn’t somebody stealing credit card numbers or breaking into a retailer’s customer database. Someone sitting behind a computer was able to interfere with physical equipment in hundreds of stores, destroying food that people depend on.
Most people have no idea how much of the modern food supply depends on internet-connected equipment. Refrigeration systems in supermarkets, warehouses and food-processing facilities can be monitored and controlled remotely. That makes maintenance easier, but it also creates another way for someone to interfere with the equipment.
Security researchers have been warning about these vulnerabilities for some time.
Researchers at Claroty’s Team82 identified security weaknesses in refrigeration controllers manufactured by Danfoss and Copeland. During testing, they demonstrated how attackers could manipulate refrigeration equipment and interfere with temperature readings.
Both manufacturers released firmware updates addressing identified security problems. But releasing an update and getting every supermarket, warehouse and refrigeration contractor to install it are two very different things.
Some of these systems have been operating for years, and stores may have little reason to replace equipment that appears to be working properly. Remote access originally installed for maintenance can also become a security problem when passwords aren’t changed or software isn’t updated.
We’ve already seen what happens when someone abuses that access. In the Netherlands, a former refrigeration contractor employee was sent to prison after using old login credentials to interfere with a supermarket’s refrigeration equipment.
The difference this time is the scale. Instead of one disgruntled employee targeting a single store, attackers in France managed to disrupt refrigeration across hundreds of locations.
A coordinated attack against hundreds of stores, distribution warehouses or food-processing facilities could become a serious supply problem.
When refrigeration fails, stores cannot simply turn the equipment back on and start selling everything again. Once perishable food has been held at unsafe temperatures, much of that inventory has to be discarded.
Replacing it takes trucks, functioning warehouses, available inventory and suppliers capable of filling new orders. If enough facilities are affected at once, replacements could be difficult to find.
And the potential problems don’t end with spoiled groceries. Refrigerated medications and other temperature-sensitive supplies depend on many of the same kinds of cooling and monitoring systems.
