Cyberattack on French supermarkets: no ransom, no answers

French investigators are trying to determine who is behind the unusual cyberattack that disrupted refrigeration systems in hundreds of supermarket branches across the country. A day after the incident came to light, it remains unknown who carried out the attack and what their objective was, and the fact that no one has demanded ransom or publicly claimed responsibility for the act is raising questions among investigators.

According to a Reuters report, at least 350 branches of French retail chains were affected, including Carrefour, Monoprix, Intermarché and Coopérative U. This represents a small fraction of the country's total supermarkets, but the damage on the ground was significant: refrigeration systems were altered in a way that compromised the required temperature maintenance, and spoiled goods had to be discarded.

The hackers took control of the refrigeration systems and activated defrost mechanisms, causing temperatures in some refrigerators and freezers to rise as high as 50 degrees Celsius. On Tuesday, crates containing spoiled meat products and frozen food were seen outside branches in Paris following the incident. Meanwhile, investigators are trying to understand how the attackers managed to penetrate the systems, and why they chose to target supermarket refrigeration facilities specifically.

Absence of ransom demand raises questions

One of the unusual features of the affair is the lack of a clear motive. Sources involved in the investigation told Reuters that investigators are struggling to understand why the attackers did not publish a statement claiming responsibility, nor did they present a ransom demand.

In many cyberattacks, criminals attempt to extract financial profit from the breach, while hacker groups operating from political motives sometimes publicize their actions to gain exposure. In the current case, as of the time of reporting, no public signs of either pattern have appeared.

Cybersecurity experts who presented their assessments to Reuters believe the attack may not have required particularly sophisticated technological capabilities. However, the precise penetration mechanism has not yet been disclosed, so it is still not possible to determine how the attackers gained control of the systems.

French Prime Minister Sébastien Lecornu ordered the National Cybersecurity Agency to investigate the attack. French authorities are coordinating the investigations with other European countries, out of concern that similar systems were compromised outside the country as well.

Known vulnerabilities in refrigeration systems

The affected refrigeration systems were based on software manufactured by the Danish company Danfoss. On Monday, the company stated that many of the affected units had reached end-of-support and no longer receive software and security updates, or are operating with outdated firmware versions.

The company recommended that its customers update supported systems to the latest versions and replace old systems with current solutions. On Tuesday, it declined to provide further comment.

The concern is not merely theoretical. On August 9, cybersecurity firm Claroty published findings about vulnerabilities in Danfoss's AK-SM 800A controller. According to the publication, these vulnerabilities, which have since been fixed, could have allowed attackers to bypass authentication mechanisms and run code on compromised devices.

Cybersecurity experts estimate that a combination of systems that were not updated and interfaces exposed to the internet may have made things easier for the attackers.

The investigation is taking place against a broader concern: the problem is not necessarily limited to supermarkets that have already been affected. In a check conducted by Reuters using the Shodan internet scanning service, at least 4,500 Danfoss system interfaces were found on Tuesday that were still accessible for viewing over the internet.

At this stage, the identity of the attackers and their purpose remain a mystery. Investigators are required not only to locate who penetrated the refrigeration systems, but also to determine whether this was a deliberate action intended to cause economic damage, an attempt to extract profit later, or an act without a clear motive. The total financial damage has not yet been published, but is already estimated at several million euros at minimum.