The cyberattack on French supermarkets earlier this week that ultimately spoiled hundreds of fridges worth of food should be a wake-up call about the vulnerabilities of digitized systems and devices that are connected to the internet, cybersecurity experts say.
“The more we rely on connected technology, the more we need to keep in mind the crucial aspect that is their security and privacy,” said Montreal-based cybersecurity expert Steven Lachance.
The attack appeared to target centralized control systems that allow the temperature of fridges to be changed remotely. Hackers were able to access those controls and jack up fridge temperatures at hundreds of grocery stores — in some cases as high as 50 C — causing their contents to spoil, and potentially causing fires.
The Paris prosecutor’s office said Tuesday that its cybercrime unit was investigating the large-scale attack to determine the extent of the damage and pin down the hackers behind it. No group has claimed responsibility so far, nor was there a ransom demand, according to Reuters.
Here’s what you need to know about the supermarket cyberattack and what it shows about the vulnerability of our tech — from commercial systems to household devices.
What happened in France?
Toronto-based tech and cybersecurity analyst Ritesh Kotak says the fridges in stores are usually connected to the internet through a centralized panel that allows metrics like temperature to be monitored and adjusted remotely.
Dominique Schelcher, CEO of Coopérative U, one of the affected French grocery store chains, said on social media that its fridges are connected to the internet in this way in order to monitor temperatures around the clock “in the event of an anomaly.”
On Monday, France’s national cybersecurity agency, ANSSI, said it was aware of numerous refrigerator control panels being compromised.
ANSSI said the remote monitoring systems targeted were made by a Dutch company called Danfoss. The cybersecurity agency later said similar systems made by Copeland and Dixell were also targeted.
View of empty refrigerators at the frozen food aisle inside an Intermarché supermarket in Paris on Tuesday. The placard reads: “Important information. Our store has been hacked, and our refrigeration system has been affected.” (Lucien Libert/Reuters)
Danfoss told news agencies on Monday that the affected units were running “outdated firmware,” or had “reached end of life and no longer receive software or security updates.”
Cybersecurity firm Claroty published a report in August detailing a vulnerability with Danfoss’s firmware that could allow hackers to bypass the standard login process and gain access in order to make changes remotely. Danfoss released a patch to fix the vulnerability shortly afterwards and urged users to install it.
“These vulnerabilities should be considered serious,” the company said in its security advisory at the time.
The exact mechanism used to hack the fridge controllers in France is still unknown, but…
Read More: A fridge hack spoiled food in hundreds of French supermarkets.
