What France’s fridge hack means for supermarkets

Last Sunday, at a Super U supermarket in the French town of Mirepoix, an alarm summoned managers to rush to the store at 2am. Two hours later, in Gradignan, a delivery driver who arrived at an Intermarché outlet discovered the storeroom was flooded. Meanwhile, in central Paris, residents watched a frozen-food aisle empty onto a Paris street, with melted ice cream spilling from broken tubs onto the pavement.

Similar scenes occurred up and down France this week after a cyberhack raised temperatures across hundreds of French supermarkets. Everything affected was discarded.

French prosecutors reported food losses and fires whilst Intermarché CEO Thierry Cotillard estimated losses of “tens of millions of euros nationwide in a single day”. Cybersecurity firm Sekoia analyst Felix Aime said the attack also affected Spain, Portugal, Poland, Germany and Belgium.

For supermarkets around the world, the scene offers a macabre example of how a refrigeration failure can affect not only stock, but also staffing and the day’s trading, leaving supermarket managers to organise repairs and replacements while explaining the depleted shelves to shoppers.

How is supermarket refrigeration managed?

Ryan Ko, director of the Cyber Research Centre at Australia’s University of Queensland, made a point that retailers need to know their equipment and who can access it. He told Australia’s public broadcaster, the ABC, that once inside, cyber hackers can change temperature set points across many locations at once. His explanation also identified compromised credentials, suppliers and vulnerable remote-access services as possible entry routes.

Today, major supermarket chains use connected systems to monitor refrigeration across their stores, but it’s unclear how widely these systems allow equipment to be adjusted remotely. Still, refrigeration controllers and heating systems connected through an app, cloud service or network can potentially be compromised, giving attackers a chance to alter settings and interrupt operations.

This was demonstrated in 2015 when researchers hacked a Samsung smart fridge at a hacking conference and intercepted internet traffic passing through it, showing that keeping a connected fridge operational also means keeping its software secure.

Running outdated firmware

Danfoss, the Danish company supplying refrigeration controls used by several affected French supermarkets, said the units “were running outdated firmware”. Reuters reported that French authorities also found affected equipment using Copeland and Dixell software, while the exact method of compromise remained undisclosed.

Although the attacker’s route remains unsolved, both an old controller and a maintenance arrangement deserve investigation. For retailers elsewhere, the incident raises questions about the security of their own equipment and the access granted to maintenance providers.

At Melbourne’s RMIT University, professor of mathematics and cyber security Asha Rao says supermarkets need to consider how an attack could interrupt everyday operations. “Disruption of services is the name of the game,” she told Inside Retail . Refrigeration and other connected equipment warrant their own risk assessments, including checks for default passwords that have been left unchanged. Rao recommends the Australian Signals Directorate’s Essential Eight, a set of eight cybersecurity measures developed by Australia’s national cybersecurity agency, as a starting point for reviewing security, with business continuity central to the exercise. “Food is a critical sector, just as water, electricity and health.”

Australia’s approach to supermarket cybersecurity

Australia offers one example of how governments assign responsibility for protecting food supply networks. Supermarket operators Woolworths, Coles and Aldi, alongside grocery wholesaler Metcash, help keep Australia’s cupboards stocked, a role the Department of Home Affairs, the government department responsible for national security, recognises as essential to Australia’s food supply. These food and grocery networks must therefore report cyber incidents and maintain written plans to identify and manage risks.

In its April 2023 submission, the Australian Retailers Association, an industry body representing retailers, called for stronger cybersecurity training, simpler incident reporting and government support for affected businesses.

“Doing risk analysis of these systems is essential to be able to continue operating,” Rao said. In Mirepoix, refrigeration was eventually restored at 9am, but €90,000 of stock had already been lost. In Gradignan, owner Charles Dezon documented the damage. “A bailiff came to confirm it: we lost €21,000 at purchase price,” he told French newspaper Le Monde .

For supermarket operators in Asia and beyond, preparedness, even with stronger cybersecurity defences, comes down to the overnight essentials: someone to answer the alarm, staff who can check temperatures and isolate affected controls, and a plan for deciding what is still safe to sell when morning shoppers arrive.

Further reading: Inside the Sephora Instagram hack that exposed Meta’s AI weakness

The post What France’s fridge hack means for supermarkets appeared first on Inside Retail Asia .