Level 1 - Absolute Beginner

Supermarkets keep food cold. They use big fridges and freezers. This keeps the food safe to eat.

In France, hackers break into the computers. They make the fridges hot. The temperature goes up to 50 degrees.

The food goes bad. Workers throw all of it away. In some shops there is a fire.

Many big shops have this problem. The police look for the hackers. The government wants answers.

supermarket

a large shop that sells food and things for the home

fridge

a machine that keeps food cold

freezer

a machine that keeps food very cold and hard

hacker

a person who breaks into computers without permission

temperature

how hot or cold something is

degree

a unit for measuring temperature

bad

no longer good or safe, used about old food

police

the people whose job is to stop crime

Level 2 - Elementary

Hundreds of supermarkets across France lost their refrigeration over the weekend after a cyberattack. Hackers reached the systems that control the fridges and freezers and forced them to defrost, pushing temperatures as high as 50C, which is 122F.

The attack began on Sunday night. At least 300 Intermarche and Netto shops were targeted, along with more than 100 Cooperative U outlets, 80 Carrefour supermarkets, about 5% of Monoprix's 490 stores, and several E.Leclerc branches. The companies called the attack unprecedented.

The food could not be saved. Intermarche told the news agency AFP that affected stores had to throw away all fresh and frozen products, and its chief executive said losses could reach tens of millions of euros nationwide in a single day. In several shops the heat started fires.

France's cybersecurity agency, ANSSI, found a weakness in software made by the Danish company Danfoss. Danfoss said that only a limited number of systems were affected and that these were running old firmware. Prime Minister Sebastien Lecornu ordered an investigation.

refrigeration

the system that keeps food cold in shops and factories

cyberattack

an attack made through computers and networks

defrost

to warm a fridge or freezer so that ice melts

target

to choose someone or something as the object of an attack

outlet

a shop or branch belonging to a larger chain

unprecedented

never having happened before

firmware

the built in software that controls a piece of equipment

investigation

an official attempt to find out the truth about something

Level 3 - Intermediate

The attack that emptied the chilled aisles of hundreds of French supermarkets did not break a single lock. Beginning on Sunday night, intruders reached the control panels that regulate commercial refrigeration and triggered forced defrost cycles, driving fridge and freezer temperatures to as much as 50C and ruining the stock inside. In several stores the heat was sufficient to start fires.

The spread was remarkable. At least 300 Intermarche and Netto shops were affected, together with more than 100 Cooperative U outlets, 80 Carrefour supermarkets, roughly 5% of Monoprix's 490 locations, and several E.Leclerc stores. Intermarche, Cooperative U and E.Leclerc each described the incident as unprecedented. Intermarche's chief executive told BFM TV that national losses could reach tens of millions of euros in a single day, and the company confirmed to AFP that affected branches must discard every fresh and frozen item.

The mechanism was mundane, which is what alarmed the specialists. Supermarket refrigeration is managed by internet facing control panels so that maintenance firms can adjust settings remotely. ANSSI, the French cybersecurity agency, reportedly identified a vulnerability in software from the Danish manufacturer Danfoss. The company responded that a limited number of systems were involved, that they were running outdated firmware, and that it had long urged customers to update or replace older equipment. The security firm Claroty had published research on 9 August describing Danfoss flaws that could let an attacker bypass authentication.

Officialdom moved quickly. The Paris prosecutor's office opened an inquiry into a large scale attack on connected refrigerators across several major food retailers, and Prime Minister Sebastien Lecornu instructed ANSSI to investigate and to coordinate with European counterparts. An analyst at the firm Sekoia told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected. Cooperative U's chief executive, Dominique Schelcher, called the attack unacceptable, while the retail federation demanded full transparency from Danfoss.

intruder

someone who enters a place or system without permission

regulate

to control the level or rate at which something operates

stock

the goods a shop holds for sale

vulnerability

a weakness in a system that an attacker can use

authentication

the process of proving that a user is who they claim to be

mundane

ordinary and unremarkable

inquiry

a formal process of asking questions to establish facts

transparency

the practice of being open about information and decisions

Level 4 - Advanced

The most instructive detail of the attack that spoiled the contents of hundreds of French supermarkets is how little ingenuity it required. Beginning on Sunday evening, intruders reached the control panels that govern commercial refrigeration and issued a legitimate command, forced defrost, at illegitimate scale. Temperatures climbed toward 50C, perishable and frozen stock was rendered unsaleable, and in several premises the thermal load was sufficient to ignite fires. No malware needed to disable anything; the equipment did as it was told.

The inventory of victims suggests breadth rather than targeting. At least 300 Intermarche and Netto shops were affected, alongside more than 100 Cooperative U outlets, 80 Carrefour supermarkets, approximately 5% of Monoprix's 490 locations, and a number of E.Leclerc branches, all three of the confirming chains characterising the episode as unprecedented. Intermarche's chief executive put potential national losses at tens of millions of euros within a single day, and the company instructed affected branches to discard fresh and frozen inventory in its entirety.

Attribution of the underlying weakness has settled on an unglamorous culprit. ANSSI, the French cybersecurity agency, reportedly located a vulnerability in software supplied by the Danish manufacturer Danfoss, whose refrigeration controllers are routinely exposed to the internet so that service contractors can tune them without a site visit. Danfoss maintains that a limited number of systems were implicated, that those units were running superseded firmware, and that it had repeatedly counselled customers to upgrade. Claroty had documented authentication bypass flaws in Danfoss equipment on 9 August, a two month interval between disclosure and exploitation that will feature prominently in the post mortem.

The institutional response has been commensurate with the embarrassment. The Paris prosecutor's office has opened an investigation into a large scale assault on connected refrigerators across major food retailers, Prime Minister Sebastien Lecornu has directed ANSSI to investigate and to liaise with European partners, and an analyst at Sekoia has told Reuters that Spain, Portugal, Poland, Germany and Belgium registered effects as well. The retail federation has demanded full transparency from Danfoss, and the cybersecurity analyst Steven Lachance, while noting that such attacks are rare in scale rather than genuinely novel, called the episode a global wake up call and observed that the same class of exposed industrial controller sits inside energy infrastructure and hospitals.

ingenuity

cleverness and originality in solving a problem

perishable

describing food that spoils quickly unless kept cold

thermal load

the amount of heat a system or space must absorb or remove

attribution

the act of identifying the source or cause of something