Investigators hunt French supermarket fridge hackers, no claim of responsibility

By Raphael Satter and Gabriel Stargardter

PARIS, Oct 13 (Reuters) - French investigators on Tuesday were hunting the hackers who seized control of cooling units at hundreds of supermarkets in a cyberattack that underlined the vulnerabilities of connected systems, with no group publicly claiming responsibility.  

The investigation comes as Dutch supermarket company Ahold Delhaize grapples with a separate cybersecurity incident that disrupted online services, although Dutch authorities said they saw no connection between the two events.

The absence of a claim of responsibility by hacktivists or a ransom demand by cybercriminals has puzzled French investigators, according to a source with knowledge of the probe. Typically, such groups tend to quickly seek to monetise their hacks or claim credit for them for political ends.

The cyberattack, which manually overrode the temperatures at fridges in supermarket groups including Carrefour, Monoprix, Intermarche and Cooperative U, appears to have been easy to pull off, three cyber experts told Reuters.

Staff at some Paris supermarkets threw boxes full of perished meat and frozen goods into giant trash containers on Tuesday. At least 350 supermarkets — a small fraction of the total number in France - were caught up in the strike.

FIRM BLAMES OUTDATED SOFTWARE

France's cybersecurity agency has said the breach affected fridges that relied on software by Danish firm Danfoss, as well as Copeland and Dixell software. 

On Monday, Danfoss said many of the affected units had "reached end of life and no longer receive software or security updates" or were "running outdated firmware". It said it had "advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions". 

The company declined further comment on Tuesday. A spokesperson for Copeland, which owns Dixell, declined to confirm the information and said the company's top priority was to protect customers' operations.

In Danfoss' case, the serious vulnerabilities present in older versions of its firmware have been known for months.

On August 9, cybersecurity firm Claroty detailed weaknesses - since patched - in the Danfoss AK-SM 800A controller that could have allowed intruders to bypass authentication and run code on compromised devices.

'BASIC CYBER HYGIENE'

Although the precise mechanism by which attackers compromised the refrigerators has not been publicly disclosed, cybersecurity experts said all signs pointed to a basic stunt enabled both by the failure to adopt Danfoss' updates and by exposing device interfaces to the internet. 

"This is about basic cyber hygiene," said Ken Munro, a partner at the British cybersecurity firm Pen Test Partners. "Get it wrong and you get a smelly mess of defrosted food."

He said the well-known vulnerabilities meant the attackers were essentially pushing at an open door, something that meant the hack could easily be "kids messing around".

"If this was a nation state, why affect only a subset of French fridges? There are plenty of other nations with fridges on the internet," he said. "No ransom or demand suggests a lack of appreciation of the potential commercial losses that the fridge owners may experience."

PROBLEM STILL EXISTS

Plenty of fridges remain reachable via the internet. Using the internet scanning service Shodan, Reuters found at least 4,500 Danfoss interfaces still viewable on Tuesday. 

Reuters could not independently establish how many of them were running vulnerable software, but French internet scanning company Onyphe said only a small minority of the devices appeared to be running the latest version of the software. 

Outdated and vulnerable versions were "still widely represented among publicly accessible interfaces", Onyphe said.

DUTCH DISRUPTION

Separately, Dutch retailer Ahold Delhaize said Tuesday it had begun "starting a controlled re-launch of certain systems" following a cybersecurity issue that began on Sunday evening.

The Dutch cybersecurity watchdog NCSC said it did not believe the incident was linked to the French supermarket hack.

Ahold operates the Albert Heijn chain in the Netherlands and several major US chains including Stop & Shop and Giant Food. Websites for stores in both countries remained offline late Tuesday afternoon, with online ordering and delivery services unavailable. 

(Reporting by Gabriel Stargardter and Raphael Satter; Additional reporting by Toby Sterling in Amsterdam. Editing by Alison Williams and Mark Potter)