Hackers Exploit Critical Flaws in Supermarket Fridge Controllers Across France
An estimated 700 French supermarkets faced refrigeration system failures after attackers exploited known vulnerabilities in three controller models previously flagged by security firms.
Key points
- Attackers targeted internet-connected fridge controllers at approximately 700 European supermarkets, causing sudden malfunctions.
- The breach exploited critical vulnerabilities in three specific models that Claroty and CISA had previously identified.
- The incident highlights the risks of unpatched industrial control systems connected to public networks.
Attackers successfully compromised internet-connected refrigeration controllers at an estimated 700 supermarkets throughout France earlier this week. This mass hack caused the cooling systems to suddenly malfunction, disrupting operations across the affected retail locations in the country.
The intrusion relied on exploiting critical vulnerabilities present in three specific models of fridge controllers. These security flaws were not unknown to the industry; both Claroty and the Cybersecurity and Infrastructure Security Agency (CISA) had previously flagged these models for their weaknesses. According to Ars Technica, the attack capitalized on these known issues to gain access to the systems.
Context and Background
The source material identifies the incident through a report by Techmeme, which cites Dan Goodin’s coverage in Ars Technica. The article describes the event as a mass hack of refrigeration systems. The vulnerabilities involved were rated as critical by the organizations that identified them.
Claroty and CISA had previously highlighted the security risks associated with these three controller models. This prior identification suggests that the necessary information to recognize the threat was available to security professionals before the large-scale disruption occurred. The attackers moved forward with the exploitation despite these earlier warnings.
Who Is Affected
The immediate impact was felt by an estimated 700 supermarkets. While the source material refers to the locations as European supermarkets, it specifically states that the malfunctioning occurred throughout France. The victims in this incident are the retail establishments that rely on these specific internet-connected controllers for their refrigeration infrastructure.
There is no information in the source material regarding other types of facilities, such as hospitals or warehouses, being affected. The scope is limited to the supermarket sector in the described region. No specific vendor names for the controllers are provided in the text, only that three models were involved.
What should you do?
Security teams should monitor for signs of unauthorized access to industrial control systems, particularly those connected to the internet. Organizations should verify if they use any of the three controller models mentioned in reports of this incident. It is crucial to review network segmentation policies to ensure that critical cooling infrastructure is not easily accessible from general corporate networks.
What to do and how to stay safe: Claroty
- Audit your inventory of industrial control systems to identify if any match the three vulnerable models flagged by Claroty and CISA.
- Review network logs for unusual traffic patterns originating from or destined to refrigeration controllers, as this may indicate active exploitation.
- Ensure that all internet-connected industrial devices are placed behind strict firewall rules and access controls to limit exposure.
- Contact your vendor to determine if a patch or update is available for the critical vulnerabilities previously identified in these models.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many supermarkets were affected by this hack?
An estimated 700 supermarkets throughout France were affected by the mass hack of their refrigeration systems.
Who identified the vulnerabilities before the attack?
Both Claroty and the Cybersecurity and Infrastructure Security Agency (CISA) had previously flagged the critical vulnerabilities in the three controller models.
What was the result of the exploitation?
The refrigeration systems at the targeted supermarkets suddenly malfunctioned, causing disruptions to their cooling infrastructure.
