Thousands of refrigerators were hacked across France. How worried should you be?

Lucien Libert/Reuters

Supermarket staffers were confronted by pools of water beneath freezers and spoiled produce earlier this week after hackers took control of refrigerators in hundreds of grocery stores across France .

Around 700 food retailers were impacted by the nationwide cyberattack, in which hackers remotely connected to refrigeration equipment, switched on defrost cycles that led to the loss of large quantities of fresh and frozen goods, according to CNN affiliate BFMTV.

French authorities have opened an investigation into what the country’s Economy Minister Roland Lescure called a “wake-up call for everyone” in an address to lawmakers on Tuesday.

Here’s what you need to know.

No group or individual has yet claimed responsibility for the cyberattack. The fact that hackers have not publicly demanded a ransom – as is often the case – suggests their primary aim was little more than to cause “mischief,” or “unsettle the public,” Ken Munro, a UK-based cybersecurity analyst, told CNN.

The hackers’ motivation is “unknown at this stage,” said Félix Aimé, principal threat researcher at French cybersecurity firm Sekoia. “To our knowledge, no public claim of responsibility has been made,” added Aimé, who previously worked at ANSSI, the French national cyber agency that is now handling the investigation.

The possibility that a lone hacker or hacktivist group carried out the attack cannot be ruled out, Aimé said. “An operation intended to destabilize certain economic activities, or infrastructure could also be considered,” he told CNN.

Moreover, the perpetrators do not appear to have used malicious code on the fridge controllers, potentially complicating efforts to track down who carried out the cyberattack, added Aimé.

The Paris prosecutors’ office said it took up the case under its national jurisdiction into the “large-scale cyberattack affecting the connected refrigerators of several major food retailers across France,” in a statement to CNN on Tuesday.

The investigation will “identify the victims and establish the link between the attacks and the damage they reported, in terms of food spoilage and fires,” the statement added.

Fridge and freezer aisles in grocery stores are operated by controllers that can be accessed online, allowing maintenance firms to adjust the temperature remotely. In France, hackers penetrated controllers run by at least three firms – including the Danish company, Danfoss, the US-based company, Copeland and Dixell – according to a statement to CNN from ANSSI.

Shortly after the cyberattack, Danfoss acknowledged that many of the impacted units “no longer receive software or security updates” or were “running outdated software.” The company urged customers to “keep supported systems updated with the latest firmware.”

Copeland, which owns Dixell, identified a “vulnerability” in a “discontinued, end-of-life generation of controllers.” “We are currently working with impacted customers to mitigate the risk,” the company told CNN in a statement.

CNN has reached out to Danfoss for comment.

The Danish firm, or the fridge installers, may have erroneously put the controllers on the public internet “for anyone to see,” said Munro, a partner at the British cybersecurity organization, Pen Test Partners.

Before the cyberattack, more than 1,700 instances of the affected Danfoss software were exposed to the internet in France, offering the hackers a broad potential target pool, said Aimé.

Earlier this year, the cybersecurity company Claroty pointed out vulnerabilities in the controllers at the center of the attack – Danfoss AK-SM 800A – citing a mechanism that “could be abused” to “bypass normal authentication,” in a report published early August. That vulnerability can allow an attacker to remotely change the temperature settings for fridges running the affected software, added Aimé.

By tapping into units’ built-in defrost function and removing limits that would usually prevent the temperature from rising, perpetrators caused the refrigerators to thaw overnight, according to UK Cyber Defence, a security analysis firm. Display cabinets peaked at 50 degrees Celsius (122 degrees Fahrenheit) for around six hours overnight Monday, with some even catching fire.

“It wasn’t hard to work out how to take control of the fridges,” said Munro, adding that unit management at these retailers was likely “outsourced to a third party who gave little to no thought to maintaining the security of these fridges.”

Major supermarket groups in France were hit by the attack, prompting warnings from retail executives that the cost of the damage could run into the millions.

As many as 80 supermarkets belonging to the French brand Carrefour were impacted, as were 5% of Monoprix’s 490 stores. Retail group Les Mousquetaires, reported that fridges at 150 shops had been targeted. About 80 Coopérative U stores were also affected, said its CEO, Dominique Schelcher.

For consumers, there is not a lot to be concerned about, said Munro. However, he cautioned that management systems for the fridges involved must be “kept off the public internet” with validated security.

“There was no business need for the fridge controllers to be accessible on the public internet,” he said. “What I do recommend is that the boards of businesses ask probing questions of their suppliers. Who outsourced the management of these fridges and who had contractual oversight for their security? It doesn’t take much for one blind spot in a business to lead to tonnes of trashed food.”

The attack sparked a wave of criticism from European officials, just weeks after French President Emmanuel Macron instructed lawmakers to draft a new protection plan against the growing threat of cyberattacks in the country, and beyond.

Sarah Meyssonnier/Reuters

Unprecedented student protests are rocking France. Here’s why they’re angry

Speaking to reporters after a meeting in Paris with political party leaders in September, Macron cited the “Russian hybrid threat facing Europeans and France,” adding that the risk had “intensified” in recent weeks, according to Reuters.

The EU Commissioner for Agriculture and Food Chrisophe Hansen warned that food security requires more attention at all levels.” “The weaponization of food has become a reality,” he posted on X on Monday.

Lescure, the French Economy Minister, allayed fears of the risk of food shortages in the country – but called on providers to bolster their cybersecurity measures.

“When we discovered this cyberattack, it worried us about the ability of our distribution chains to properly deliver food to all our fellow citizens,” he said on Tuesday. “This is a wake-up call for everyone.”

CNN’s Sean Lyngaas contributed reporting.

路透社/卢西恩·利伯特

本周早些时候，黑客控制了法国数百家杂货店的冰箱，导致超市员工发现冷冻柜下积水，农产品腐烂变质。

据 CNN 附属电视台 BFMTV 报道，此次全国性网络攻击影响了约 700 家食品零售商，黑客远程连接到制冷设备，启动除霜循环，导致大量新鲜和冷冻食品损失。

法国当局已对此事展开调查。法国经济部长罗兰·莱斯库尔周二在向议员发表讲话时，称此事是“给所有人敲响的警钟”。

以下是您需要了解的内容。

目前还没有任何组织或个人声称对此次网络攻击负责。英国网络安全分析师肯·芒罗告诉CNN，黑客没有像通常那样公开索要赎金，这表明他们的主要目的可能仅仅是制造“混乱”或“扰乱公众秩序”。

法国网络安全公司Sekoia的首席威胁研究员费利克斯·艾梅表示，黑客的动机“目前尚不清楚”。艾梅补充道：“据我们所知，目前还没有任何公开声明对此负责。”艾梅此前曾在法国国家网络安全局（ANSSI）工作，该机构目前正在负责调查此案。

艾梅表示，不能排除此次攻击是由一名黑客或黑客组织单独实施的可能性。他告诉CNN：“也可以考虑这是一次旨在破坏某些经济活动或基础设施的行动。”

此外，艾梅补充说，犯罪者似乎没有在冰箱控制器上使用恶意代码，这可能会使追踪网络攻击实施者的努力变得更加复杂。

巴黎检察官办公室周二在给 CNN 的一份声明中表示，他们已根据国家管辖权受理了这起“影响法国多家大型食品零售商联网冰箱的大规模网络攻击”案件。

声明还补充说，调查将“确定受害者身份，并查明袭击事件与他们所报告的损失（例如食物腐败和火灾）之间的联系”。

超市的冷藏和冷冻区由可在线访问的控制器控制，维护公司可以远程调节温度。据法国国家信息系统安全局（ANSSI）向CNN发布的消息，黑客入侵了至少三家公司（包括丹麦丹佛斯公司、美国科普兰公司和迪克塞尔公司）的控制器。

网络攻击发生后不久，丹佛斯公司承认，许多受影响的设备“不再接收软件或安全更新”，或者“运行的是过时的软件”。该公司敦促客户“将受支持的系统更新到最新固件”。

拥有 Dixell 的 Copeland 公司发现“已停产、生命周期结束的一代控制器”存在“漏洞”。该公司在一份声明中告诉 CNN：“我们目前正在与受影响的客户合作，以​​降低风险。”

CNN已联系丹佛斯公司寻求置评。

英国网络安全组织 Pen Test Partners 的合伙人 Munro 表示，这家丹麦公司或冰箱安装商可能错误地将控制器放在了公共互联网上，“任何人都可以看到”。

艾梅表示，在网络攻击发生之前，超过 1700 个受影响的丹佛斯软件实例在法国的互联网上暴露，为黑客提供了广泛的潜在目标范围。

今年早些时候，网络安全公司Claroty在8月初发布的一份报告中指出，此次攻击的核心控制器——丹佛斯AK-SM 800A——存在漏洞，并提及一种“可能被滥用”的机制，该机制可以“绕过正常的身份验证”。Aimé补充说，该漏洞可能允许攻击者远程更改运行受影响软件的冰箱的温度设置。

据安全分析公司英国网络防御公司（UK Cyber​​ Defence）称，不法分子利用冰箱内置的除霜功能，并移除通常防止温度升高的限制，导致冰箱在一夜之间解冻。周一晚间，展示柜的温度在约六个小时内飙升至50摄氏度（122华氏度），部分冰箱甚至起火。

门罗说：“要弄清楚如何控制这些冰箱并不难。”他还补充说，这些零售商的冰箱管理很可能“外包给了第三方，而第三方几乎没有考虑过维护这些冰箱的安全”。

法国多家大型超市集团受到袭击，零售业高管警告称，损失可能高达数百万英镑。

法国家乐福旗下多达80家超市受到影响，Monoprix旗下490家门店中也有5%受到影响。零售集团Les Mousquetaires报告称，其150家门店的冷藏柜遭到破坏。Coopérative U首席执行官多米尼克·舍尔彻表示，该集团旗下约80家门店也受到影响。

门罗表示，对消费者而言，无需过度担忧。但他同时提醒，相关冰箱的管理系统必须“与公共互联网隔离”，并采用经过验证的安全措施。

他说：“冰箱控制器完全没有必要暴露在公共互联网上。我建议各企业董事会向供应商提出深入质询。这些冰箱的管理外包给了谁？谁负责冰箱的安全监管？企业中哪怕一个疏忽都可能导致大量食物被浪费。”

此次攻击引发了欧洲官员的强烈批评，而就在几周前，法国总统埃马纽埃尔·马克龙指示立法者制定一项新的保护计划，以应对法国乃至全球日益严重的网络攻击威胁。

萨拉·梅索尼尔/路透社

前所未有的学生抗议活动席卷法国。以下是他们愤怒的原因

据路透社报道，马克龙在9月于巴黎与各政党领导人会晤后对记者表示，他提到了“欧洲人和法国面临的俄罗斯混合威胁”，并补充说，这种风险在最近几周“加剧了”。

欧盟农业和食品专员克里斯托夫·汉森警告说，粮食安全需要在各个层面都得到更多重视。他周一在X网站上发帖称：“粮食武器化已经成为现实。”

法国经济部长莱斯库尔缓解了人们对该国食品短缺风险的担忧，但呼吁供应商加强网络安全措施。

“当我们发现这次网络攻击时，我们担心我们的配送链能否正常地将食品送到所有民众手中，”他周二表示。“这对每个人来说都是一个警钟。”

CNN的肖恩·林加斯对此报道亦有贡献。