What We Know About the Supermarket Refrigerator Cyberattacks in Europe

Using the same modus operandi as the attack in France, several dozen stores across Belgium, Luxembourg, Sweden, and Estonia fell victim between Sunday evening, November 1, and Monday morning, November 2, to an "unprecedented" cyberattack targeting their refrigeration systems.

In Estonia, where at least one supermarket was attacked by hackers who raised refrigeration unit temperatures to 50°C, the devices were older models supplied by Danfoss, similar to those targeted in the French attack, Jann Mutso, director of Kitman Coldtech, an Estonian manufacturer and distributor of connected refrigeration systems, told public broadcaster ERR. "The 'signature' is the same, but I cannot say more," he stated.

In Sweden, where stores belonging to the Ica chain experienced refrigeration failures, group spokeswoman Helena Johansson stated that all affected stores were connected to an external refrigeration monitoring system provided by Danish manufacturer Danfoss.

Following the attack in France, Danfoss told AFP that most of the impacted devices were legacy products that "no longer receive software or security updates."

European Commissioner for Agriculture and Food Christophe Hansen had then stated that "food safety requires more attention at all levels," adding that "targeting food" has now become "a reality."

No entity has yet claimed responsibility for these attacks.

• Legacy Equipment

Long kept isolated from the internet, industrial systems such as refrigeration units are now connected to enable remote monitoring and control, explains Antoine Hautin, secretary-general of cybersecurity consultancy Almond.

The objective for the hackers here is to manipulate physical equipment through a computer system.

"These are devices that regulate the temperature across multiple refrigerators. Most of the time, it is a web interface. You log in with a password and have the ability to select the temperature applied to the refrigerator," explains Kévin Tellier, a cybersecurity engineer at Synacktiv.

These interfaces "are normally located within a closed network" and "are not supposed to be accessible from the internet." However, a number of them were exposed "to anyone with a minimal amount of knowledge," he adds.

Without appropriate protections, "any factory, any connected piece of equipment"—whether in automotive, energy, or transportation—could be exposed to similar scenarios, estimates Olivier Daloy, a cyber expert at Zscaler.

According to a cyber expert who spoke on condition of anonymity, industrial infrastructures are vulnerable because they bridge information technology (IT) systems with operational technology (OT) physical equipment, some of which is aging.

In Sweden, six of the roughly 800 stores in the Coop chain fell victim to Monday's cyberattack. Spokesperson Carlos Cancino told AFP that Coop did not know who was behind the attack, but noted that the six affected stores were connected to a 4G mobile network rather than the updated 5G system, making them "more exposed" to hackers.

• "Basic Security Flaws"

By breaching computer networks, hackers can access systems that directly control this equipment, causing real-world disruptions.

Two primary scenarios are possible, notes Olivier Daloy: exploiting a technical vulnerability or using compromised credentials to log into the equipment.

In France, the October cyberattack was made possible due to "basic security flaws," according to Vincent Strubel, director general of the National Cybersecurity Agency of France (ANSSI).

Also read: Binance Cryptocurrency Platform Hack: FBI Accuses North Korea

Chief among these were "the direct exposure of refrigeration equipment to the internet and administering them without specific security measures, using weak passwords," he noted.

Behind this attack, "it could be anyone." Because it was not "extremely sophisticated, it is impossible to determine whether the perpetrator has significant resources or not," points out Kévin Tellier.

France Info reported that the connected refrigerators targeted in France were listed in online directories. Breaching them merely required guessing the password. "There was therefore no need to be an experienced cyberattacker," the news outlet explained.

• A Lack of Anticipation

According to numerous experts, these attacks reveal a failure of anticipation. Such equipment was never designed to withstand the exceptionally rapid evolution of cyber threats.

Speaking on BFM, Benoît Grünemwald, public affairs director at cybersecurity firm ESET, urged supermarkets to take inspiration from critical sectors where "best practices have existed for a very long time and cybersecurity maturity is extremely high." In other words, major retail players and companies using connected devices must build digital and cybersecurity expertise.

Also read: Billions of Leaked Records: How BrixHub & Co Put Women at Risk

Elevators, building heating systems, and consumer connected devices (such as baby monitors) are all potential targets for future attacks. The most concerned experts are calling for genuine awareness across retailers, manufacturers, and users alike.

With AFP and Reuters