Hackers Turn Up the Heat on French Supermarkets
Cyber attacks normally bring to mind stolen passwords, encrypted laptops or a worrying email from the IT department.
In France, however, attackers decided to target the frozen peas.
Hundreds of supermarkets have been affected by a major cyber attack involving internet-connected refrigeration systems. Attackers were able to manipulate the equipment controlling fridges and freezers, causing temperatures to rise dramatically overnight.
Some units reportedly reached 50C, leaving stores with little choice but to throw away fresh and frozen food that could no longer be considered safe.
Major retailers including Coopérative U, Intermarché, Netto, Carrefour and Monoprix were among those affected.
When Smart Equipment Stops Being Quite So Smart
Modern supermarket refrigeration systems can be remotely monitored and adjusted, making maintenance considerably easier.
Unfortunately, anything that can be accessed remotely also needs to be properly secured.
The affected systems used technology from Danish engineering company Danfoss. Reports indicate that outdated firmware was running on some impacted equipment, while previously identified security weaknesses had already highlighted risks associated with older refrigeration controllers.
French authorities have launched an investigation, with the country’s cyber security agency examining the incident.
The financial impact could be considerable. Spoiled stock across hundreds of stores means losses potentially running into millions of euros, without even considering disruption to normal trading.
Cyber Security Meets the Real World
The incident is a useful reminder that cyber attacks are no longer limited to computers and data.
Connected operational technology controls everything from heating and manufacturing equipment to building management systems and supermarket refrigeration.
If those systems are compromised, the consequences can become very physical, very quickly.
Organisations using connected equipment should keep firmware updated, restrict remote access, monitor unusual activity and remove unsupported technology wherever possible.
Apparently even the fridge now needs a patching policy.