France’s Supermarket Fridges Exposed Online for Months Before Cyberattack

The refrigeration dashboards that attackers abused at French supermarkets on the night of Oct. 11 had been sitting open on the internet for at least six months, according to an analysis of internet scans published by IPinfo on Monday.

In its Oct. 6-7 sweep, five days before the attack, IPinfo found 2,528 addresses showing a Danfoss StoreView dashboard, the web page stores and technicians use to watch and manage refrigeration controllers. France had 1,331 of them, more than the 1,197 found across the other 72 countries and territories combined. Poland was next with 179, followed by the U.S. with 101.

Most of the French systems were behind on security. IPinfo counted 85% running software with known flaws, including 527 older controllers Danfoss no longer supports, and only 195 had every available fix. France wasn’t patching worse than anyone else, since the flawed share elsewhere was 84%. It simply had far more of these devices online.

Same devices, same addresses

Every weekly scan from late March until the attack found between 2,464 and 2,622 Danfoss dashboards exposed, about half of them in France. Of the 1,331 French dashboards seen on Oct. 6, 1,019 had been at the same address on March 30. Over those six months, the share of newer French controllers with every known fix rose only from 14% to 24%.

The attack itself pushed refrigeration units into defrost mode at hundreds of stores. Some reached 50°C, and the Paris prosecutor’s office said equipment caught fire. About 700 of France’s roughly 10,000 supermarkets were affected, Finance Minister Roland Lescure told lawmakers, according to SecurityWeek. Carrefour, Coopérative U, E.Leclerc, Intermarché and Monoprix have confirmed they were hit.

How the attackers got in is still unknown. France’s CERT-FR hasn’t tied the compromises to a specific vulnerability. In August, Claroty disclosed flaws in Danfoss’s current AK-SM 800A controller, including a hidden login based on the date. Danfoss said most affected units were older AK-SM 800 and AK-SC 355 systems, which stopped getting support in May 2021 and 2016, respectively. CERT-FR later added Copeland and Dixell XWEB supervisors to its alert, and a Copeland spokesperson told Cybersecurity Dive that a vulnerability was found in “discontinued end-of-life controllers.” No group has claimed responsibility.

After the attack, stores pulled their dashboards offline rather than patching them. IPinfo’s Oct. 14 scan found only 316 of the 1,331 French dashboards still at the same address, a 76% drop, compared with the 3% to 7% that normally disappear in a week. Fully updated units fell from 195 to 54, and unsupported ones from 527 to 64.