Hackers warmed French supermarket freezers. What Australian businesses can check

In short: A supermarket cyber attack in France warmed fridges and freezers in hundreds of stores overnight, spoiling stock. Researchers had already reported thousands of refrigeration controllers reachable online. Businesses with remotely managed equipment can take simple steps now.

Attackers warmed supermarket fridges and freezers across France overnight, forcing stores to throw out food. Australian cyber security experts say the same could happen here if refrigeration controls are left exposed online.

What happened in the supermarket cyber attack

French authorities are investigating what the ABC described as a "large-scale" cyber attack on supermarkets. Les Mousquetaires, which owns the Intermarché chain, said fridges at about 150 of its stores were heated to 50 degrees Celsius for six hours overnight, according to the ABC.

Citing Agence France-Presse and Reuters, the ABC reported that hundreds of stores across several chains were affected, including Intermarché and its Netto brand, Coopérative U, E.Leclerc, Carrefour Market and Monoprix. Intermarché's chief executive told local media the losses would run to "tens of millions of euros nationwide".

How the attackers got in has not been officially confirmed. Reuters reported, citing a source close to the French Prime Minister, that France's national cyber security agency had identified a vulnerability in software supplied by the Danish company Danfoss. Danfoss said it was aware of incidents in France affecting a limited number of refrigeration management systems, and that the affected units "were running outdated firmware". The investigation is continuing.

The weakness researchers had already found

In August, researchers at the security firm Claroty published findings on the Danfoss AK-SM 800A, a controller used to manage refrigeration in stores. They reported three vulnerabilities in its web management interface, including a hidden "code of the day" login that could bypass the administrator password, and a flaw allowing remote code execution.

Claroty also searched internet scanning services for these controllers and reported 2,765 devices with their management interface reachable from the public internet. It said Danfoss had fixed the vulnerabilities in firmware version R4.3.1, and advised owners to upgrade "as soon as possible".

It is not yet confirmed whether these specific flaws were used in France.

Could it happen in Australia?

Experts told the ABC it is possible, especially where supermarkets use similar systems. University of Queensland professor Ryan Ko said attackers often get in through stolen passwords, vulnerable remote access services, third-party suppliers or poorly secured platforms for managing equipment. Once inside, he said, they can change temperature settings across many sites at once. Macquarie University's Dr Jennifer Williams said Australian retailers were likely to be alert to copycat attacks.

What businesses can check

This is not just a supermarket issue. Any business with remotely managed fridges, cool rooms, heating or building controls has similar systems, known as operational technology. The Australian Signals Directorate's guidance on principles of operational technology cyber security covers how to think about them. Practical first steps include:

• find out what you have: list every controller and who can reach it remotely, including maintenance contractors

• take management screens off the open internet: Claroty recommends restricting access to trusted networks or VPNs

• keep firmware up to date: check with your supplier whether a security update applies to your model

• change default and shared passwords, and remove access for contractors who no longer need it

• have a fallback: know how you would spot and respond to an unexpected temperature change, and how you would protect stock.

Related on AusLume Media

• Could your small business manage a morning without its main system?

• Your backup needs a restore test, not just a success message

• The one security step worth doing today: multi-factor authentication

Cover photo: Maryland Pride via Wikimedia Commons, licensed under CC BY-SA 3.0. Cropped to fit.

This story was researched and drafted with the help of an AI assistant from the ABC report, Claroty research and Australian Signals Directorate guidance linked above, then checked and edited by AusLume Media before publication.