Shortly before midnight last Sunday, the digital thermostats controlling hundreds of supermarket cold aisles across France began to flicker and rise.
asserted
thermostats → control → France
In a “bizarre and unprecedented” cyber-attack, hackers had remotely overridden the temperature settings on thousands of freezers, fridges and chiller cabinets pushing them from as low as -27C (-16.6F) to well over 50C (122F).
asserted
hackers → override → 50C
Over the next four to six hours, the food inside first defrosted, then slowly began to cook.
asserted
food → defrost → hours
Shop staff arriving early to restock shelves reported catching a blast of hot air, like opening an oven, when they went to fill freezers.
asserted
they → arrive → freezers
One Normandy supermarket reported a number of its freezers had been pushed to 80C (176F).
asserted
number → report → 80C
In certain stores, the extreme temperature rise had sparked fires triggering sprinklers and water damage.
asserted
rise → spark → sprinklers
“It was a catastrophe,” said one worker at the large Intermarché supermarket in the south-west suburb of Issy-les-Moulineaux in Paris.
asserted
worker → say → Paris
“They pushed the freezers here up to 62C.
asserted
They → push → freezers
Everything had to be thrown away.
asserted
Everything → have → ?
After removing tons of spoiled food, staff at the store worked until almost midnight on Monday to reorder and restock shelves.
asserted
staff → remove → shelves
“Thankfully, we were able to get things almost back to normal the same day,” another shop worker added.
asserted
worker → get → ?
“But we had to clear out everything in the freezers.”
asserted
we → have → freezers
If shop managers first assumed it was an isolated failure, it soon became clear up to 700 stores – including those from the Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix chains along with a number of smaller independent shops – had been victims of a cyber-attack.
asserted
stores → assume → attack
Dominique Schelcher, the president of Coopérative U, said 80 of its 2,000 supermarkets had been targeted.
asserted
80 → say → supermarkets
In my entire professional career, I’ve never seen anything like it,” the shocked executive told French radio.
asserted
executive → see → radio
The Paris public prosecutor’s office immediately opened an investigation into the latest in a series of cyber-attacks that have made France the most hacked country in Europe.
asserted
France → open → Europe
Gérôme Billois, a partner in the cybersecurity and technology company Wavestone, said the hack had the hallmarks of political sabotage.
asserted
hack → say → sabotage
“The two most feasible scenarios are either it was a group of youngsters or activists who wanted to blow up a few freezers to prove what they could do, or it was a destabilising attack, what we call sabotage, by internal or external state actors,” he said.
uncertain
he → want → actors
“As for the attack’s signature, the most likely scenario is still a destabilisation attack – one designed to convey the message to populations that they are not safe, to convey the impression that the government is falling apart, and ultimately to instil fear.
asserted
government → design → fear
The hackers had pirated the controllers supplied by the Danish company Danfoss that controls the freezers and fridges.
asserted
that → pirate → freezers
Most supermarket cold aisles are connected to the internet to allow remote maintenance and alerts for system failures.
asserted
aisles → connect → failures
Initial investigations suggest the hackers disabled alarm systems before tampering with the thermostats, or extended the defrost programme by several hours to avoid triggering alarms.
asserted
hackers → suggest → alarms
Danfoss said it had identified security flaws last year and had “long recommended” that customers install updates or replace obsolete unsupported systems.
asserted
customers → say → systems
The affected refrigeration units were “running outdated firmware”, it said.
asserted
it → run → firmware
In the days following the first wave of attacks, France’s cyber-attack alert centre ANSSI confirmed supermarkets using controllers from two other companies were also targeted.
asserted
supermarkets → follow → companies
Marta Rybczyńska, a cybersecurity specialist and researcher, said she had found previous security warnings about old supermarket freezers running out-of-date software and newer models not having firmware updated.
asserted
firmware → say → software
“Some of these freezers hadn’t been supported by the manufacturers for several years and there were notices saying they should be replaced.
asserted
they → support → years
Other freezers were newer but the software hadn’t been updated,” Rybczyńska said.
asserted
Rybczyńska → update → ?
“The hackers found these weaknesses and used them.”
asserted
hackers → find → them
She added: “Many of the freezers appear to have been running with a default password.
asserted
Many → add → password
The hackers were able to modify or turn off the alerts so the shops only realised when the first person arrived in the morning and saw the damage that had been done.
asserted
that → modify → damage
The most recent French cyber-attack mirrors a similar incident in the US in August when connected fridges and freezers at a dozen military commissaries – on-base food stores – went into unscheduled defrost cycles overnight causing massive food loss.
asserted
fridges → mirror → loss
France is the most heavily pirated country in Europe by the volume of records exposed by hackers, according to the cybersecurity and risk management company Upguard.
uncertain
France → pirate → company
In the last three years, hackers have breached France’s health system, France Travail, the government-run jobseekers agency, the National Agency for Identity Documents (ANTS) and most of the big mobile phone companies.
asserted
hackers → breach → companies
This summer, the economy and finance ministry lost the personal and fiscal records of 678,000 taxpayers to a series of cyber-attacks.
asserted
ministry → lose → attacks
Billois says France has fallen behind in addressing cybersecurity and has still not adopted the EU’s Cyber Resilience Act (2024) that introduced mandatory security for internet-connected devices.
asserted
that → say → devices
“It’s a text that’s not political and that everyone agrees on but is delayed because there’s always more urgent legislation or there are quibbles about amendments, and this has been a disaster,” he said.
asserted
he → ’ → amendments
In the UK, the cyber security and resilience (network and information systems) bill to tackle cyber threats, is wending a similarly tortuous way through parliament.
asserted
bill → tackle → parliament
However, it fails to directly cover the food industry.
asserted
it → fail → industry
Supermarket boss Schelcher was quick to shift the blame for the attack on to unnamed refrigeration contractors who maintain the cold aisle equipment.
asserted
who → shift → equipment
…and 12 more, not listed.
The Aporia
