France's Supermarket Fridges Were Vulnerable Online for Months

A vulnerability in a temperature monitoring system used in French supermarkets allowed hackers to access sensitive data, including sales data and customer information, for months. The vulnerability, discovered in October 2022, was patched in March 2023, but it's unclear how many supermarkets were affected. The system, provided by the company Transalis, was used to monitor temperature levels in refrigerators and freezers at over 100 supermarkets, mostly in the Paris region. An investigation by the French data protection authority, the CNIL, found that the vulnerability was first reported in October 2022, but it wasn't patched until March 2023. The hackers, likely from Eastern Europe, accessed the data through a publicly accessible API. The data accessed included sales data, customer information, and employee data. The investigation is ongoing, and the CNIL is working with the company to determine the extent of the breach.