SaxX stated that a cyberattack targeting Danfoss regulatory systems affected around 500 supermarkets in France during the night of October 11 to 12, including Intermarché, Netto, Coopérative U, Market, Monoprix, and Leclerc stores. According to him, the attackers forced the defrosting of equipment, with instructions reaching up to 50 °C. Two stores in Alsace alone reportedly recorded losses of 270,000 euros. Relying on information from a cyber official of a major brand, SaxX indicated that the vulnerability concerned three types of equipment and had been known since July, without clients being informed. Only one of the three types had a patch, which needed to be installed manually by refrigerant technicians, store by store. He added that the connected refrigerators used 3G cards installed by technicians, outside of the network and control of the brand's IT teams. The equipment would have been shut down, and the stores would have switched to manual mode, with a return to operation expected within the day, while the application of the patch would take longer. According to SaxX's analysis, the targeted versions were earlier than version 4. He reminded that Danfoss had fixed an authentication bypass vulnerability in version R4.2 related to passwords generated from the date and time. If these elements were confirmed, he estimated, it would not be a “zero-day” vulnerability, but rather a delay in updating. He also noted that Shodan still listed more than 3,700 Danfoss interfaces accessible from the Internet in August. SaxX said that France seemed to be the only country affected for the moment. He mentioned possible explanations such as the size of the French Danfoss park, a common provider or access channel, or deliberate targeting, while clarifying that nothing was established. He finally reported that his contact feared that other organizations might be more affected, particularly those whose activities relied mainly on frozen products. SaxX also indicated that he intervened at midday on TF1’s newscast to talk about the attack and possible motivations of the state group or hackers. #cyberattaque #sécuritéinformatique #France (translated)