A cyber-intrusion earlier this month that caused supermarket refrigeration units in France to overheat, destroying food and causing fires, was carried out by exploiting basic security failures, such as weak passwords and a lack of rudimentary cyber defences, France’s cyber agency ANSSI told lawmakers.

The comments by ANSSI head Vincent Strubel to the French Senate contradict earlier reports indicating the agency had identified the exploitation of flaws in outdated refrigerator firmware in the attacks.

The incident highlights concerns around “hybrid attacks” that could disrupt critical physical infrastructure.

The attacks affected supermarket chains including Coopérative U, Carrefour, Intermarché, Monoprix and Netto, with some units heated to up to 80°C (176°F) for several hours.

Immediately following the large-scale incident on the night of Sunday, 11 October, reports had indicated that ANSSI was focusing on outdated refrigerator firmware from Denmark’s Danfoss.

Strubel said the agency’s current assessment was that these vulnerabilities were not exploited.

“These were basic security flaws, starting with the direct exposure of refrigeration equipment to the internet and its administration without any particular security measures, weak passwords, that sort of thing,” he said, in comments earlier reported by the .

Third-party management

Supermarket chains in France generally outsource management of their refrigeration systems to third-party contractors and are not in direct control of the systems’ security arrangements, according to local media reports.

“A company’s fundamental responsibility is to deploy these systems securely, whether or not they apply the rules” recommended by ANSSI, Strubel said.

He said ANSSI had worked with hospitals, pharmacies and laboratories following the attack to ensure their refrigeration systems were protected.

No one has claimed responsibility for the refrigerator attack.