BRUSSELS (The Thursday Times) — Hackers have found a new way to hurt superstores: they switch off the cold. In about three months, freezer failures have hit US military stores, hundreds of supermarkets in France and now shops across seven more European countries, and nobody has said who is doing it.
What happened
In August, freezers failed at more than half a dozen US military commissaries, from Fort Irwin in California to Robins Air Force Base in Georgia. The Pentagon’s criminal investigators are leading a joint inquiry and officials are treating it as a possible cyberattack, though there is no proof yet that it was one, or that it is linked to what followed.
On the night of October 11, hackers took over refrigeration controls at hundreds of French supermarkets, including Carrefour, Monoprix, Intermarché and Coopérative U. Temperatures rose as high as 50 degrees Celsius, food was spoiled and there were fires at several stores. The Paris prosecutor called it a “large-scale” attack.
On Monday it happened again, this time at dozens of stores in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland. A single Delhaize branch in Belgium said it had lost €100,000 of produce.
How do you hack a freezer?
Big stores run their cold rooms through small controllers that can be reached online, so that engineers can fix faults remotely. Many chains leave this to outside contractors. An alert from French authorities named Danfoss, Copeland and Dixell controllers, and said the affected units were running outdated firmware that hackers could reach over the internet.
Once in, the attackers did not need to break anything. They switched the units to defrost mode overnight, when shops are shut. At one store in Stockholm the attack came at 2am and was not noticed until 5.30am.
“Once an attacker can operate those controls, legitimate functions such as defrosting become tools for disruption,” said Tom Hegel of the cybersecurity firm SentinelOne. “Changing a setting can destroy physical stock, not just interrupt a computer system.”
Who is behind it?
Nobody knows. There has been no claim of responsibility and no government has named a culprit. Security researcher Ken Munro has said the French attack was simple enough to be “kids messing around”, though states such as Russia and Iran also have the capability.
European Agriculture Commissioner Christophe Hansen called the attacks “a deliberate attempt to disrupt” food supplies and undermine public confidence. European governments have blamed Russia for a growing number of sabotage incidents, which Moscow denies.
Why it matters, and what stores can do
Most cyberattacks can be cleaned up. This kind cannot. “You can’t unspoil food or other products from these freezers. It’s just euros and dollars down the drain,” said Christopher Whyte of Virginia Commonwealth University.
The fixes being urged are basic: take controllers off the open internet, connect only over a secure link, and update the software. Sweden’s cybersecurity chief said his agency had found many exposed devices there and told owners to patch them. Researchers in Britain, which has reported no attacks, found more than 800 refrigeration and building-control systems tied to retailers that could be reached online. Some units need physical changes as well, said the head of a Belgian refrigeration company.
The bigger question for retailers is who is responsible, Hegel said: “who owns the security of that equipment, not just who repairs it”.
No attack on a superstore in Pakistan has been reported. There is also no evidence that home fridges are being targeted, though experts advise keeping any connected device updated.
