Danfoss Refrigeration Controllers Compromised in Attack on European Retailers
Hackers manipulated cooling systems at hundreds of stores, causing food spoilage and significant financial losses across multiple European countries.
Key points
- Attackers targeted Danfoss controllers, raising temperatures to 50 degrees Celsius in affected freezers and refrigerators.
- Major chains including Carrefour, Auchan, and Monoprix reported damage, with over 300 locations impacted in France alone.
- The incident follows Claroty’s disclosure of vulnerabilities in the AK-SM 800A platform that allow remote code execution.
A coordinated cyberattack manipulated refrigeration controllers across hundreds of European supermarkets, causing widespread food spoilage. Attackers remotely adjusted temperature settings to defrost units, resulting in significant monetary damages for major retail chains.
What happened
According to Reuters, the attack targeted several prominent supermarket chains across Europe, including Auchan, Carrefour, E.Leclerc, Intermarché, and Monoprix. The majority of the disruption occurred in France, though retailers in Belgium, Germany, the Netherlands, Poland, Portugal, and Spain also experienced issues. Cooperative U CEO Dominique Schelcher confirmed on X that his company’s stores, operating under brands like Hyper U and Super U, were among those affected. He stated that teams are coordinating with refrigeration specialists to restore operations and that an investigation is underway.
Security researcher Lukasz Olejnik described the incident as a remote takeover of refrigeration controllers. Attackers reportedly set target temperatures to 50 degrees Celsius (122 degrees Fahrenheit) during the night. Staff members discovered the problem in the morning when they opened freezers and encountered hot air. The temperature anomaly persisted for approximately six hours before employees identified the breach.
French news outlet BFM TV reported that more than 300 supermarket locations in France were impacted. The total financial losses are estimated to reach millions of euros. Schelcher emphasized the severity of targeting essential food preservation equipment, calling the unprecedented attack unacceptable for the French food supply.
Why it matters
The attack exploited vulnerabilities in Danfoss refrigeration controllers, specifically tampering with settings overnight. This incident occurred roughly two months after cybersecurity firm Claroty disclosed flaws in the Danfoss AK-SM 800A management platform. Claroty reported that these vulnerabilities could allow attackers to bypass authentication, execute arbitrary code remotely, and inject configuration directives. The firm also noted that thousands of AK-SM 800A management interfaces were publicly accessible.
Claroty had previously urged customers to upgrade their systems to firmware version R4.3.1, which contains patches for these issues. The current attack suggests that some organizations may not have applied these updates promptly. The ability to remotely manipulate physical equipment highlights the risks associated with internet-connected industrial control systems. This event underscores the critical need for timely patching of operational technology.
What to watch
- Monitor vendor advisories for new firmware updates addressing remote code execution flaws.
- Track reports of similar incidents involving other industrial control system manufacturers.
- Observe regulatory responses regarding the security of essential infrastructure equipment.
What to do and how to stay safe: Danfoss
- Audit all internet-facing industrial control system interfaces to ensure they are not publicly accessible.
- Verify that all Danfoss AK-SM 800A platforms are running firmware version R4.3.1 or later to address known authentication bypass flaws.
- Implement network segmentation to isolate critical refrigeration controls from general corporate networks.
- Review logs for unusual configuration changes or remote access attempts on operational technology devices.
Step-by-step guide: Social Engineering: How Manipulation Bypasses Technical Defenses
General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific Danfoss product was targeted in this attack?
Attackers compromised Danfoss refrigeration controllers, specifically exploiting vulnerabilities in the AK-SM 800A management platform.
Which supermarket chains were confirmed to be affected?
Reuters reported impacts on Auchan, Carrefour, E.Leclerc, Intermarché, and Monoprix, with Cooperative U also confirming involvement.
Is there a patch available for the vulnerabilities?
Yes, Claroty stated that firmware version R4.3.1 contains the necessary patches for the disclosed vulnerabilities.
