科技 · 制冷系统遭黑客攻击

法国超市遭黑客攻击，食品变质，零售商争分夺秒确保制冷系统安全

变质库存和据报发生的火灾，显示出制冷控制系统遭黑客攻击造成的实际损失。零售商必须在确保冷链安全的同时关闭暴露在外的远程访问。

播出 文字 阅读需 10 分钟83 个来源HeyDay News Desk · About usWatch report
与 HeyDex 一起探索

通过 RSS 关注

原语言视频

文字实录 · 正在加载

译自英文原文。

新闻追踪第 6 天

1 篇报道58 家媒体83 个来源16 个视频

  • 暂无标注日期的事件
  1. 第 1 次更新法国超市遭黑客攻击，食品变质，零售商争分夺秒确保制冷系统安全当前位置

原本应该售出的新鲜和冷冻食品不得不被丢弃。在法国数百家超市，攻击者在夜间远程操纵制冷控制系统，导致员工不得不丢弃变质库存；一些门店还要处理设备损坏和据报发生的火灾。一名门店经理称，店内所有新鲜和冷冻农产品都损失了。7

对零售商而言，眼下的任务比补货更艰巨：既要让食品保持安全冷藏，又要阻止外人接触控制系统。根据Global News于10月14日发布的报道，法国网络安全机构警告称，攻击行动可能仍在进行。这一警告并不等于确认当天发生了新的入侵，但危险也尚未被宣布解除。1

最明确的时间线将此次中断定于2026年10月11日星期日夜间至10月12日星期一。Capital报道了这一夜间时段。Global News在10月14日的报道中称，攻击发生在星期日；FRANCE 24于10月13日的报道则称，门店在星期一遭到攻击。这些说法可能指的是同一个夜晚，并不能证明发生了多轮攻击。确切的开始和结束时间仍然未知。28 1 6

据报道，攻击者在门店无人值守时更改了温度设置或启动了除霜系统。相比其获取访问权限的途径，制冷控制系统遭到接管这一点有更充分的证据。调查人员尚未确定具体利用了哪项漏洞，关于共用供应商平台遭入侵的说法也未获证实。8 20

数百家门店受影响，全国总数尚无定论

Les Mousquetaires公布的数字显示，300家Intermarché和Netto门店据报受影响，而非法国各地共有300家门店受影响。Public Sénat的细分数据还列出80家家乐福超市、80家U超市、约30家Monoprix门店，以及数量未明的几家E. Leclerc门店。由于部分数字为约数，另一些则缺失，无法得出精确总数。28 80

全国受影响数量的估算仍未统一。10月13日，ABC News Australia根据各连锁商提供的数据估算约500家；Global News报道至少350家；NBC News估计约700家，约占法国约10,000家超市的7%。仅凭发布时间无法解释这些差异。目前没有经过统一核对的门店清单或统计方法，无法确定较高估算反映的是更广的报道范围、更多事件，还是其他口径差异。这些数字不得相加。14 5 4

CTV News在10月13日的报道中还列出了西班牙、葡萄牙、波兰、德国和比利时的受影响门店。据报道，法国当局正与欧洲各方协调，处理类似事件，但没有经过核实的各国数量，也没有统一的入侵路径。关于加拿大和澳大利亚可能面临风险的警告属于风险评估，并非这些国家发生了攻击的报道。9 8 1 14

报道所述温度或设定值最高达到50°C，即122°F。部分报道称温度超过100°F，或接近50°C。更重要的是，报道有时说的是控制器设定值，有时说的是设备内部温度。没有具体门店的传感器日志和时间戳，就无法据此认定所有门店读数一致。ABC News转述了一名专家的说法，称部分设备加热了六小时或更久；这并非对所有受影响设备经过独立计时核实的持续时间。6 7 4 5 13

经济损失相当可观，但尚未核算清楚。FRANCE 24报道，巴黎郊区一家超市估计变质产品损失达€55,000。NBC转述了Intermarché首席执行官的说法，称预计成本达数百万欧元；Reuters报道，零售商的预计损失最高达数千万欧元。这些是不同规模的估算，并非经过审计的账单。15 3 7

以美元计价的损失估算也从数百万美元到数千万美元不等，但未始终明确具体币种，因此不能简单地与欧元估算相加。设备损坏和销售中断可能使影响超出食品更换成本，但目前没有可单独核实的损失分项。11 4 7

火灾报告表明，这不只是库存被丢弃的问题。巴黎检察官办公室在其说明中提及火灾和食品损失，但报道没有确定完整的火灾数量、所有发生地点、起火原因或伤情信息。没有伤情报告，并不能证明无人受伤。43

断开远程访问，而不是关闭制冷

CERT-FR的警报CERTFR-2026-ALE-012于10月12日首次发布，并于10月13日修订。转载的警报文本点名提及Danfoss AK-SM和AK-SC控制器、Copeland XWEB和Dixell XWEB系统；Claroty称，10月13日的修订将Copeland和Dixell设备纳入点名范围。列出这些产品系列，并不代表每种型号或每套安装设备都以相同方式易受攻击。36 37 38

转载的警报指出，将管理界面暴露在互联网上通常不符合良好实践。针对尚未遭入侵设备的指引，第一步是移除其互联网暴露。这意味着关闭暴露在外的远程管理接口，而不是明确要求关闭制冷设备。这里没有提供针对已遭入侵和未遭入侵设备的完整处置流程，因此无法根据现有证据给出经核实的密码更改、固件处理和报告步骤顺序。37 39

至少有一名门店经理告诉FRANCE 24，为降低再次遭受攻击的风险，该店已停用冷藏设备的远程操作。这是具体的应对措施，但不能证明所有地方都已将攻击者拒之门外。报道期间，一些生鲜和冷冻食品货架仍然关闭，也没有确定统一的重新开放日期。15 12

Danfoss表示，大多数受影响设备属于已达到生命周期终点的旧产品系列，已不再获得软件或安全更新，或运行着过时的固件。ABC后续报道指出，较新的型号未受影响，并称该公司正在协助客户。这些说法缩小了已报告的受影响范围，但并非对所有受影响型号逐一进行的独立核实清单。15 3 2

昆士兰大学网络研究中心主任Ryan Ko教授将暴露在外的远程管理系统描述为攻击者查找和操纵制冷控制系统的途径。FRANCE 24采访的Ygreky网络安全专家Marta Rybczynska也强调了可通过互联网访问的管理系统和已有多年历史的固件。他们的评估解释了其中的风险，但并未确定每家门店的入侵方式。59 10 49 6

新南威尔士大学教授Richard Buckland认为，遭入侵的中央服务商或许可以解释多家零售商同时受到影响的情况。这仍只是一种假设。他建议设置独立警报并进行人工监督，以应对更深层的问题：运营方需要能够发现危险变更，而且不能完全依赖遭到操纵的控制器。Ko另行提出的人工智能可能加速漏洞利用开发的警告，属于一般性分析；没有证据表明此次攻击使用了人工智能。61 14 10

已知

  • 巴黎检察官办公室网络犯罪部门已展开调查，CERT-FR也发布了制冷控制器警报。 636

未知

  • 攻击者身份、动机、确切入侵方式、完整的实际损失以及最终损失金额仍未确定。

后续

  • 零售商能否确认制冷安全、关闭暴露的访问途径，并在不再发生中断的情况下重新开放受影响货架，仍有待观察。

截至现有的10月14日报道，尚无团体公开宣称对此事负责。涉及相关问题的报道未提及数据盗窃或赎金要求；但这并非通过取证确认两者均未发生。6 8

已有事实清楚表明，将制冷安全视为可有可无的计算机开支是站不住脚的。这些控制系统保障着一项基本的实体需求。恢复运营不仅仅意味着设备重新运转：零售商必须确认食品安全，并确保外人无法改变维持食品安全的条件。

本报道的消息来源

广播报道：Global News 1 5；ABC News 2 11 13；NBC News 3 4；FRANCE 24 English 6 15；Reuters 7；CBS News 8；CTV News 9；ABC News Australia 10 14；Bloomberg Television 12；Guardian News 16。

事件及技术报道：The Hack Academy 17；Cybernews 18；Claroty 19 38；TSN Media 20；Food Tech Insider 21；Flawfence 22；CBS News 23；Time 24；Le Nouvel Obs 25；P.K. Sharma 26。

零售商及食品行业报道：Associated Press 27；Capital 28；ABC News Australia 29；FoodNavigator 30；Pollar 31；Industrial Cyber 32；Al Jazeera 33；Threatcluster 34；The Connexion 35。

警报及后续报道：CERT-FR 36 81；Vulnerability-Lookup转载版本 37；CyberTechEdition 39；Security.io 40；AIGYROS GROUP 41；FRANCE 24 42；NBC News 43；CBC News 44；CNBC 45；Al Jazeera 46；Y94 47；Insurance Business 48。

专家访谈及分析：FRANCE 24 49；CBC News 50；iTnews 51；Al Jazeera 52；ABC News Australia 53；Auslume 54；Globalsconflicts 55；Tim McAllister 56；Securitysignal 57；Duke FM 58。

身份信息参考：昆士兰大学人物简介、名录及团队页面 59 60 62 63 64 66 67 68；新南威尔士大学人物简介 61；Richard Buckland的LinkedIn个人资料 65。

政策参考资料：欧盟委员会 69；EUR-Lex法规及PDF 70 71；CRA Evidence 72；Phinasoft 73；Cybernova Labs 74；Cyber Resilience Act Explained 75；EUVerify 76；NISD2.eu 77；INNOSYS 78。

其他事件参考资料：Gridinsoft 79；Public Sénat 80；Maître Reda Kohen 82；Cybernova Labs 83。

播出原貌 27 行
  1. Hackers forced hundreds of French supermarkets to throw away fresh and frozen food. Retailers face spoiled stock, damaged equipment and reported fires, while France’s cybersecurity agency warns attack campaigns could still be underway. Can stores keep food safely chilled while shutting outsiders out of their refrigeration controls?
  2. Staff emptied refrigerated and frozen sections after attackers remotely interfered with the equipment keeping products cold. Some fresh and frozen aisles remained closed. One store director described losing all the store’s fresh and frozen produce.
  3. The disruption struck overnight, while stores were unattended. Attackers reportedly changed temperature settings or activated defrost systems, allowing equipment to warm for hours. The clearest timing places the attack across the night of October 11 into October 12, 2026.
  4. Sunday-night and Monday descriptions can refer to that same overnight disruption. Retailers confirmed the damage on Monday. The timing doesn't show two separate waves of attacks, and nobody has given precise start and finish times.
  5. The heating was prolonged. Some descriptions put it at six hours or more, while others describe several hours overnight. Those are estimates of what happened to some equipment, rather than a single measured duration across every affected store.
  6. Some refrigeration settings or temperatures reportedly reached up to 50 degrees Celsius, equivalent to 122 degrees Fahrenheit. Other descriptions put them above 100 Fahrenheit. The figures mix settings and appliance readings, so they don't show every cabinet reached the same temperature.
  7. Les Mousquetaires reported 300 affected Intermarché and Netto stores. That gives a concrete measure of the damage within one retail group. Other major chains were hit too, and their figures explain why the impact extends well beyond that group.
  8. The retailer breakdown also identifies 80 Carrefour supermarkets, 80 U stores and around 30 Monoprix stores. Several E. Leclerc stores were affected too. With an approximate Monoprix figure and no Leclerc count, that breakdown can't produce an exact national total.
  9. The national estimates disagree. They range from at least 350 stores to about 500 or about 700. Their publication times don't explain the differences, and the figures shouldn't be added together or treated as proof that new attacks kept increasing the toll.
  10. The higher estimate puts about 700 of France’s 10,000 supermarkets in the affected group, roughly seven percent. But nobody has reconciled the store lists or explained the counting methods behind the different national estimates.
  11. French authorities are also coordinating with European counterparts over similar incidents. The reported reach includes five other countries, although the damage in each country hasn't been counted and investigators haven't connected every incident through one common intrusion route.
  12. Stores in Spain, Portugal, Poland, Germany and Belgium were also reportedly affected. Experts warn that similarly connected equipment could expose retailers elsewhere, including Canada and Australia, to the same kind of physical disruption.
  13. A supermarket in a Paris suburb estimated its spoiled-product losses at 55,000 euros. Intermarché’s chief executive expected costs in the millions of euros, and other retailer estimates reached tens of millions. Those estimates cover different scopes and aren't a final bill.
  14. Dollar-denominated estimates also run from millions to tens of millions, but the currency isn't consistently specified. They can't simply be combined with the euro figures. Retailers also face equipment damage and interrupted sales beyond the cost of replacing food.
  15. The Paris prosecutor’s office included food losses and fires in its account of the attack. Fires were reported at some stores, but the ignition mechanism and full damage haven't been explained. Fresh and frozen sections were still closed at some locations during the reporting.
  16. France’s cybersecurity agency urged operators to remove internet exposure from affected units. Its warning targets the remote-management connection. Retailers still need cooling to protect food, and at least one store director said the store had disabled remote operation of its cold units.
  17. The agency’s CERT-FR alert was first issued October 12 and revised October 13. It described numerous compromises of remote refrigeration controllers. The revision widened the named equipment beyond Danfoss to include systems from Copeland and Dixell.
  18. The warning names Danfoss AK-SM and AK-SC, Copeland XWEB and Dixell XWEB controller families. Danfoss says most affected units came from an old product line without security updates, or were running outdated firmware, the software embedded in the equipment.
  19. Danfoss also says newer models were unaffected and it's working with affected customers. Its explanation points to aging connected controls that remained in service after security support ended. Investigators still haven't identified the precise flaw or initial access method used in the attacks.
  20. University of Queensland professor Ryan Ko says exposed remote-management systems give attackers a route to find and manipulate refrigeration controls. Cybersecurity expert Marta Rybczynska, at Ygreky, also points to internet-accessible administration, years-old firmware and missing basic security measures.
  21. Ko recommends checking online exposure, investing in security and encouraging prompt reporting. He also warns that AI can accelerate vulnerability discovery and exploit development, potentially compressing hours or days of work into minutes or seconds. That's his general assessment of the technology.
  22. UNSW professor Richard Buckland suggests a compromised central provider might explain why multiple retailers were hit. Investigators haven't confirmed that hypothesis. He warns about a single point of failure and recommends independent alarms and human oversight to catch dangerous changes.
  23. The Paris Public Prosecutor’s Office opened a cybercrime investigation, alongside the national cybersecurity agency’s work. By October 14, no group had publicly claimed responsibility. No data theft or ransom demand had been reported. Investigators haven't announced the attackers’ identity or motive.
  24. The EU Cyber Resilience Act sets a broader direction for secure design, updating and maintenance of connected products. Its reporting obligations began September 11, 2026. The main obligations are scheduled for December 11, 2027, though these controllers’ precise legal classification hasn't been settled.
  25. France’s separate NIS2 cybersecurity legislation was still pending in early October. The Senate passed the bill in March 2025, and an Assembly committee approved it that September. The Assembly floor stage was postponed October 6, 2026.
  26. Retailers have begun closing exposed remote access while trying to restore food storage and sales. The agency warns campaigns could still be underway. Disconnecting a remote connection can reduce exposure, but retailers haven't demonstrated that attackers have been excluded everywhere.
  27. France’s finance minister called the attack a wake-up call. Stores now have to protect two things together: the temperature keeping food safe and the controls deciding that temperature. There’s still no common reopening date for affected fresh and frozen aisles.

来源

83 个来源58 家媒体16 个视频

来源地图

追溯本篇报道的依据。图谱展示其关联；下方链接可打开本文引用的来源。

来源图谱将在您阅读时加载。

探索完整的新闻编辑室图谱 ↗

译文更新于

修订记录

  1. r1首次发布。