Fridge hackers exploited ‘basic security flaws’ at French retailers

Hackers who took control of fridges in hundreds of French supermarkets exploited the retailers’ basic security flaws to pull off a cyber attack that ruined food and started fires, the head of the country’s cyber security agency has said.

Vincent Strubel, head of cyber security agency ANSSI, told the French Senate on Wednesday that it appeared that weak passwords and a lack of rudimentary cyber defences enabled criminals to gain access to the connected fridge systems this month.

In some cases, fridges full of food were heated to temperatures as high as 80C. The extraordinary attack raised alarms in France, with Coopérative U boss Dominique Schelcher describing it as an “unprecedented” and “extremely serious” assault on the country’s food security.

Other affected chains included Carrefour, Intermarché, Monoprix and Netto. The cost of ruined food and damaged equipment could run into tens of millions of euros across the industry, according to Thierry Cotillard, president of Les Mousquetaires group, which owns Intermarché and Netto.

ANSSI’s initial findings appear to contradict third-party analyses, which had identified security vulnerabilities in the firmware of outdated versions of the fridge software that was compromised.

“Our analysis today is that these vulnerabilities were not exploited. These were basic security flaws, starting with the direct exposure of refrigeration equipment to the internet and its administration without any particular security measures, weak passwords, that sort of thing,” said Strubel.

Most supermarket chains outsource management of their refrigeration systems to subcontractors, a person with knowledge of the situation noted, adding that operators did not know their systems were unprotected or that the passwords were weak.

ANSSI has regularly updated its published guides for protecting industrial systems since 2014. “Clearly, our recommendations are not systematically followed,” Strubel said. “We have no control over this today and a company’s fundamental responsibility is to deploy these systems securely, whether or not they apply the rules” recommended by the agency, he added.

Les Mousquetaires declined to comment. The rest of the retailers affected by the attack did not respond to requests for comment.

Investigations into the hack by ANSSI and the cyber crime unit of the Paris prosecutor’s office are ongoing. No-one has yet claimed responsibility for the attack and no perpetrators have been identified.

Strubel said ANSSI works with organisations in other critical industries to ensure facilities such as hospitals, pharmacies and laboratories have protected their refrigeration systems.

“We carried out extremely intense, very rapid and very effective work with [health authorities and companies] to ensure that these fridges used to store sometimes dangerous, sometimes essential materials to the health of our fellow citizens were well protected,” he said.