French investigators on Tuesday were hunting the hackers who seized control of cooling units at hundreds of supermarkets in a cyberattack that underlined the vulnerabilities of connected systems, with no group publicly claiming responsibility.
The absence of a claim of responsibility by hacktivists or a ransom demand by cybercriminals has puzzled investigators, according to a source with knowledge of the probe. Typically, such groups tend to quickly seek to monetise their hacks or claim credit for them for political ends.
The cyberattack, which manually overrode the temperatures at fridges in supermarket groups including Carrefour, Monoprix, Intermarche and Co-operative U, appears to have been easy to pull off, three cyber experts told Reuters.
Staff at some Paris supermarkets threw boxes full of perished meat and frozen goods into giant trash containers on Tuesday. At least 350 supermarkets — a small fraction of the total number in France – were caught up in the strike.
The affected fridges relied on software by Danish firm Danfoss.
On Monday, Danfoss said many of the affected units had “reached end of life and no longer receive software or security updates” or were “running outdated firmware”. It said it had “advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions”.
The company declined further comment on Tuesday.
The serious vulnerabilities present in older versions of Danfoss’ firmware have been known for months.
