Full Report
French supermarket chain Intermarché was among several retailers in France hit by a cyberattack that manipulated connected refrigeration... The post Intermarché cyberattack exposes refrigeration security risks as French supermarkets face operational disruption appeared first on Industrial Cyber.
Analysis Summary
# Incident Report: French Supermarket OT Exploitation
## Executive Summary
Multiple French supermarket chains, including Intermarché and Carrefour, suffered a widespread cyberattack targeting connected refrigeration systems. Attackers manipulated Industrial Control Systems (ICS) to spike temperatures to 50°C, causing food spoilage and fires. The incident highlights the vulnerability of Internet-exposed Operational Technology (OT) and the potential for cyber-physical damage in the retail supply chain.
## Incident Details
- **Discovery Date:** October 12, 2026
- **Incident Date:** October 12-13, 2026 (Overnight)
- **Affected Organization:** Intermarché (Les Mousquetaires), Carrefour, Monoprix, Coopérative U
- **Sector:** Retail / Food & Agriculture
- **Geography:** France
## Timeline of Events
### Initial Access
- **Date/Time:** Overnight, October 12, 2026.
- **Vector:** Likely exploitation of Internet-exposed refrigeration management interfaces.
- **Details:** The attack likely leveraged vulnerabilities in centralized system managers (such as the Danfoss AK-SM 800A) which are frequently left accessible via the public web for remote maintenance.
### Lateral Movement
- **Details:** Information not fully disclosed, but the attack involved moving from the management interface to the individual refrigeration and freezer circuits.
### Data Exfiltration/Impact
- **Details:** No reported data exfiltration. The primary impact was **Cyber-Physical**: Temperatures were remotely increased to 50°C (122°F), leading to mass food spoilage and isolated incidents of fire within units.
### Detection & Response
- **Discovery:** Detected via temperature alarms and physical observation of equipment failure/smoke during the six-hour overnight window.
- **Response actions:** ANSSI (French National Cybersecurity Agency) was deployed to investigate; retailers initiated manual overrides and emergency maintenance.
## Attack Methodology
- **Initial Access:** Likely exploitation of CVE-2025-41450 (authentication bypass) or CVE-2025-41451 (command injection) on exposed OT controllers.
- **Persistence:** Not specified; likely transient exploitation of management interfaces.
- **Defense Evasion:** Targeted OT systems that often lack traditional IT security monitoring/EDR.
- **Discovery:** Scanning for publicly reachable management interfaces (e.g., via Censys).
- **Impact:** Manipulation of set-points in ICS/OT environments to cause physical damage and operational disruption.
## Impact Assessment
- **Financial:** Significant; costs associated with mass food disposal and equipment repair.
- **Data Breach:** None reported.
- **Operational:** Approximately 150 Intermarché stores, 80 Carrefour stores, and 5% of Monoprix stores experienced disruptions.
- **Reputational:** High public visibility due to potential health risks from spoiled food and fire hazards.
## Indicators of Compromise
- **Network indicators:** Traffic to/from ports associated with Danfoss AK-SM 800A management interfaces (Web/HTTP/HTTPS).
- **Behavioral indicators:** Unauthorized changes to temperature set-points; "Code-of-the-day" authentication bypass attempts; Nginx configuration anomalies.
## Response Actions
- **Containment:** Disconnecting compromised refrigeration controllers from the public internet.
- **Eradication:** Implementation of firmware updates (Danfoss R4.3.1) to patch known vulnerabilities.
- **Recovery:** Inspection of refrigeration units for physical damage; restocking of spoiled inventory.
## Lessons Learned
- **OT/IT Convergence:** Vulnerabilities in OT systems can have immediate physical consequences that bypass traditional IT security controls like Point-of-Sale (PoS) protection.
- **Shadow OT:** Many critical control systems are exposed to the internet for "convenience" without the knowledge of the central security team.
## Recommendations
- **Asset Discovery:** Conduct scans to identify all internet-facing OT and ICS devices.
- **Network Segmentation:** Place refrigeration and HVAC controllers behind a VPN or firewall; do not expose management interfaces directly to the web.
- **Patch Management:** Prioritize firmware updates for CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452.
- **Monitoring:** Implement OT-specific monitoring to alert on anomalous set-point changes (e.g., sudden temperature spikes).