French authorities are actively searching for the individuals behind a cyberattack that seized control of refrigeration units in more than 350 supermarkets across the country. The incident, which forced staff in Paris stores to discard spoiled meat and frozen goods, underscores the vulnerabilities of legacy industrial software.
Outdated firmware at the heart of the breach
The compromised fridges rely on control software from Danish firm Danfoss. The company confirmed that many of the affected units had “reached end of life and no longer receive software or security updates” or were running “outdated firmware.” Danfoss urged customers to update to supported versions or replace legacy systems with newer solutions.
Security researchers had warned about the weaknesses in Danfoss’s AK‑SM 800A controller for months. In August, cybersecurity firm Claroty detailed flaws that could allow attackers to bypass authentication and execute code on the devices. Those vulnerabilities were patched, but the older, unpatched units remain exposed.
Experts call it a basic cyber‑hygiene failure
Ken Munro, a partner at Pen Test Partners, described the attack as a result of “basic cyber hygiene” lapses. He noted that the hackers likely exploited the open internet interfaces of the fridges, a scenario he likened to “kids messing around” when proper security updates are ignored.
Munro also questioned the motive, pointing out that no ransom demand or political claim has been made. “If this were a nation‑state operation, why target only a subset of French fridges?” he asked, suggesting the breach may be opportunistic rather than strategic.
Millions of devices still vulnerable
Using the Shodan internet‑scanning service, Reuters identified at least 4,500 Danfoss interfaces still publicly accessible on Tuesday. French scanning firm Onyphe reported that only a small minority of those devices appear to be running the latest firmware, meaning many remain susceptible to the same flaws.
The incident highlights a broader challenge for businesses that rely on connected industrial equipment: without regular updates and proper network segmentation, critical infrastructure can become an easy target for cybercriminals.
What retailers can do
Industry experts recommend that retailers audit their IoT devices, ensure firmware is up to date, and isolate such equipment from public internet exposure. Danfoss has advised customers to migrate legacy systems to current‑generation solutions that receive ongoing security patches.
As investigators continue to trace the source of the attack, French supermarkets are left to manage the immediate fallout—cleaning out spoiled inventory and reassuring customers that steps are being taken to prevent future incidents.
Original reporting: Appleton, WI News Feed (HLL/CB) — read the source article.
