Remote Manipulation of Danfoss Controls Warmed Supermarket Fridges
Attackers allegedly altered settings in French stores, raising temperatures to 50°C and forcing the disposal of perishable goods.
Key points
- The incident affected Intermarché, E.Leclerc, and Système U networks overnight between October 11 and October 12.
- Attackers reportedly targeted Danfoss refrigeration-control systems, forcing continuous defrost cycles and setting temperatures to 50°C.
- Around 150 Intermarché stores were impacted, with some facing losses of hundreds of thousands of euros due to spoiled stock.
French supermarket chains experienced a significant operational disruption when attackers reportedly manipulated remote refrigeration settings. This incident turned cooling units into heaters, raising internal temperatures to 50°C. The breach affected stores within the Intermarché, E.Leclerc, and Système U networks, according to early reporting by Cyber Security News.
Root cause
The attack appears to have targeted industrial technology systems manufactured by Danish firm Danfoss. These controllers manage compressors, chilled displays, and temperature alerts. By altering software configurations, the intruders triggered continuous defrosting modes. This prevented the equipment from maintaining safe storage conditions for dairy, meat, and frozen products.
Attack path
Reports suggest the intruders abused a standard defrost feature within the management software. Defrosting normally removes ice accumulation from cooling coils. However, forcing this process continuously or applying unsafe parameter values stops the unit from cooling. This allowed refrigeration units to operate like heaters for several hours during the overnight incident.
Affected versions
Early indicators point to older software versions being involved in the breach. However, the exact intrusion method remains unconfirmed. The responsible threat group has not been identified. It is also unclear whether a known public vulnerability was exploited or if this was a targeted configuration abuse.
Mitigation
The chief executive of Coopérative U, Dominique Schelcher, confirmed cybercriminal activity impacted the group’s refrigeration systems. Teams are currently working with specialists to restore normal operations. An investigation is underway to determine the precise entry vector. No specific patch or update has been confirmed as a fix yet.
What to do and how to stay safe: Danfoss
- Monitor industrial control system logs for anomalous changes to defrost cycle durations or temperature setpoints.
- Segment refrigeration management networks from general corporate IT to limit lateral movement from compromised endpoints.
- Verify that software versions on critical infrastructure devices are up to date with vendor-supplied security patches.
- Implement strict change management controls that require dual authorisation for modifying critical environmental parameters remotely.
Step-by-step guide: DDoS Protection for Dedicated Server: Architecture and Mitigation
General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which supermarkets were affected by this incident?
Stores linked to Intermarché, E.Leclerc, and Système U were reportedly affected, with approximately 150 Intermarché locations cited.
What specific component was targeted?
The attack targeted refrigeration-control systems made by the Danish industrial technology company Danfoss.
Has a patch been released for this issue?
No fix has been confirmed yet, as the exact intrusion method and responsible group remain unconfirmed.
