Refrigeration Controller Hack Spoils Food Across European Supermarkets

What it is

A multi-country attack on supermarket refrigeration in which Danfoss refrigeration controllers were reportedly taken over remotely and their target temperature set to 50°C (122°F). The product at the centre of the earlier Claroty disclosure is the Danfoss AK-SM 800A management platform. Whether that disclosure is connected to this attack is not established.

Scope and impact (as reported)

• Chains named: Auchan, Carrefour, E.Leclerc, Intermarché (Groupement Mousquetaire), Monoprix, and Cooperative U (Hyper U, Super U, U Express, Utile).
• Most damage was in France. Retailers in Belgium, Germany, the Netherlands, Poland, Portugal and Spain were also affected.
• BFM TV puts French sites at more than 300, with losses estimated in the millions of euros.
• The changes were made overnight. In some equipment the temperature rose for about six hours before staff noticed. Staff opening freezers in the morning met a wave of hot air (per Lukasz Olejnik).

Preconditions / Affected

• Claroty's earlier disclosure covers the Danfoss AK-SM 800A management platform. The flaws allow authentication bypass, remote code execution, and injection of arbitrary configuration directives.
• Claroty found thousands of publicly reachable AK-SM 800A management interfaces. Internet exposure is the precondition that matters.
• The page names no CVE IDs and gives no affected-version range beyond the fixed version.

What to do

• Upgrade AK-SM 800A units to firmware R4.3.1, the version Claroty says contains the patches.
• The page does not state this, but the exposure Claroty describes suggests checking whether any management interfaces are reachable from the internet.
• For sites that already ran these controllers, check for unexpected setpoint changes overnight. The page offers no detection guidance, so this is my inference, not the article's.

Caveats

• The page says it is unclear whether the attackers exploited the flaws Claroty disclosed. The two-month gap is circumstantial.
• The 50°C figure, the 300+ French stores and the multi-country scope come from Reuters, BFM TV and a researcher's comment, not from a confirmed investigation. Cooperative U's CEO said an investigation is still needed.
• The initial access method is not described.