Hundreds of sabotaged commercial refrigerators in France could have been protected had their owners heeded warnings and applied readily available security patches, an expert says amidst warnings that Australian grocers and other firms are “absolutely” exposed to similar attacks.

Over 500 French supermarkets, including major chains E. Leclerc, Intermarché, and Cooperative U, were forced to throw out entire aisles of fresh and frozen stock after cybercriminals hacked internet-connected refrigerators, heating them to temperatures of up to 50oC.

The attack, which also affected some grocers in Spain, Portugal, Poland, Germany, Belgium, Luxembourg, and The Netherlands, reportedly caused fires at several locations, with total losses expected to reach into the tens of millions of euros.

It was traced to refrigeration controllers from Danish firm Danfoss, whose units are widely used across industrial environments and include a web-connected administration portal and ‘code-of-the-day’ feature that lets passwords be bypassed.

Danfoss confirmed their involvement in a statement to Agence France-Presse, while Cooperative U chief executive Dominique Schelcher condemned the “unprecedented” and “unacceptable” attack in a post on X.

“Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is extremely serious and is unprecedented,” Schelcher wrote, confirming that 80 stores were affected and thanking employees’ “responsiveness” in countering the attack.

The affected systems “are connected to the internet to enable remote temperature monitoring around the clock, day and night, and rapid intervention in the event of an anomaly,” he added, calling the systems “essential … for the proper preservation of food products.”

Authorities mobilised quickly, with French cybersecurity agency ANSSI noting in a bulletin that “generally speaking, exposing a management interface to the internet is contrary to good practice” and warning that “attack campaigns are probably still underway targeting this equipment.”

An accident waiting to happen

The attack was no surprise to security experts that have seen global attacks on cyber-physical systems (CPS) escalate during the Ukraine-Russia conflict.

Team 82, a specialist group within CPS security company Claroty that actively probes such systems for vulnerabilities, months ago identified the specific vulnerability used during this attack, documenting the vulnerability and notifying Danfoss and rival Copeland.

Both companies “were very diligent” in addressing the issue and “very quickly” released firmware patches, Claroty field chief technology officer Jason Pearce told Information Age.

Yet even when patches are available, many companies wait to apply them – a point Telstra learned the hard way in July, after its failure to apply a patch for six years caused a major nationwide service outage.

“When you’re talking about an asset that’s running 24-7 and is not built for security, you can’t just apply a patch,” Pearce explained, noting that such patches must be tested and scheduled for a change window in a process that can take “weeks, or sometimes even longer.”

Adding to the challenge, equipment in distributed sites is often installed and effectively ignored because it functions as intended long after its official end of life (EOL).

Telstra’s affected server was well past its EOL, for example, while Danfoss’s AK-SC355 system was phased out in 2016.

“The bigger challenge here,” Pearce added, “is that you've got systems that were accessible from an internet connection that should never have had an internet connection in the first place.

“And the fact that you can just jump on Shodan [a search engine for internet-connected devices] and search for these devices is an issue in itself.”

Heading off a bigger attack

The hack has been sobering for grocery chains, but its potential scope is far wider given the same refrigeration controllers are widely used in hospitals, pharmaceuticals, biotechnology, telecommunications, air conditioning systems, and other critical environments.

Australian firms are “absolutely” exposed, Pearce said, noting that “these controllers are used throughout Australia in multiple industries”.

A similar attack disabling the cooling of an Australian data centre, for example, could cause millions of dollars’ worth of server equipment to melt down, creating “an unrecoverable situation” that could compromise untold numbers of online services hosted from the facility.

Recent Claroty research found 80 per cent of Australian and New Zealand businesses have seen a cyberattack on operational environments in the past 12 months.

Affected organisations reported average losses of $2.04 million from cyber incidents, nearly twice the global average of $1.04 million, while 52 per cent said they had limited or no visibility into connections by third parties into their CPS and operational technology environments.

Such persistent risks are part of the reason data centres, food and grocery supply chains, and other industries were added to the scope of Australia’s security of critical infrastructure (SOCI) legislation, which is currently being revisited with an eye on expanding its reach significantly.

Yet SOCI compliance is only the start, with Pearce advising operators of CPS equipment to review whether they have the right updates, check for external web management consoles that can be accessed from the internet, and remove default credentials.

These actions, he said, “will alleviate 90 per cent of the risk.”

“The best thing we can do in this country is to really understand our exposure,” he said.

“… Companies should be making those changes today to ensure they don’t become targets tomorrow.”