Hackers hit European supermarket refrigeration systems, spoiling food and forcing stores to dump stock

[Shawn Knight]

In a nutshell: Cyber attackers are causing major headaches for grocery shoppers across Europe. On Sunday night, hackers targeted refrigeration systems at around 150 Intermarché stores, forcing employees to toss out food that is no longer safe to consume. And that's only the tip of the iceberg.

A spokesperson for the supermarket chain told Bloomberg that attackers infiltrated controls for the cooling systems and activated the defrost mode, which heated them to 50 degrees Celsius, or 122 degrees Fahrenheit. Roughly six hours passed before employees noticed. By that time, all of the food in the coolers had been ruined.

The attack wasn't limited to Intermarché stores. According to Agence France-Presse, fewer than 100 Cooperative U stores were also hit. BMF added that some Leclerc stores were also impacted. La Dépêche reports that electronic pricing label systems were also impacted.

Bloomberg said the systems targeted in the Intermarché attack were managed by Danfoss. Just a few months back, security researchers with Team 82 published a report highlighting multiple vulnerabilities in Danfoss refrigeration controllers that could lead to this exact sort of attack. It is no surprise, then, that an attack materialized in the real world.

The immediate fallout from the attack isn't fully clear, outside of the obvious inconvenience to shoppers, supermarket employees, and food suppliers. Early reports pin the financial loss at around 300,000 euros, but that figure could climb much higher as the full scope of the attack comes into focus.

Dominique Schelcher, CEO of Cooperative U, said teams have been dispatched to their stores to fix the issue, adding that they will conduct a full investigation into the matter. No suspects have been publicly identified as of this writing.

It is entirely possible that this was a test run used by the attackers to demonstrate its effectiveness. If deployed in conjunction with other destructive attacks on the power grid or utilities, the effects could be devastating. It is the sort of worst case hacking scenario we've been warned about for years – fortunately, it hasn't materialized... yet.

Permalink to story:

Hackers hit European supermarket refrigeration systems, spoiling food and forcing stores to dump stock

 

[Notmare]

You know, I totally get being able to monitor these over the internet, but configurable over the internet?

 

[Neatfeatguy]

Refrigeration units and freezers have functioned just fine for decades without ever having the need to be connected to the internet.

Not very much needs to be connected to the internet, it just gives more failure points.

 

[opckieran]

You know, I totally get being able to monitor these over the internet, but configurable over the internet?

These days, everything should be assumed to have a backdoor. If you can see it, somebody is already figuring out how to break into it.

 

[Theinsanegamer]

These days, everything should be assumed to have a backdoor. If you can see it, somebody is already figuring out how to break into it.

there are ways to prevent this. Having the management engineer be a separate system that provides read only into to the web facing side, requiring a physical telnet connection to make changes, would prevent this.

But paying workers to manage these systems gets in the way of profit margins, so they’d rather make them all remote and risk things like this. Guarantee this failure wiped out all the savings this system could have ever possibly provided.

 

[StefanTJ]

there are ways to prevent this. Having the management engineer be a separate system that provides read only into to the web facing side, requiring a physical telnet connection to make changes, would prevent this.

But paying workers to manage these systems gets in the way of profit margins, so they’d rather make them all remote and risk things like this. Guarantee this failure wiped out all the savings this system could have ever possibly provided.

A lot of stuff cuts into the bottom line. A few years back (less than 10), I saw an ATM from ING Bank in Romania expose its underlying OS, which was Windows XP (already out of extended support at the time), running DameWare.

 

[Skully]

I don't know what I can say that hasn't been said above. I've been in the tech industry for 30 years, and the more I know, the more I don't want ANYTHING that doesn't have to have internet access to have it. You're just asking for trouble. Maybe it was here, but I was reading about "Smart" home refrigerators where the manufacturers just push new firmware with no intervention from the owner. And what happens if they decide to change their terms and you don't agree? Yeah, no thanks.

 

[J Oelschl]

This is infuriating for many reasons but mostly for the incredible waste of food when so many are starving. How did the tech chief not put these systems on an inaccessible network from outside the intranet. These systems must be isolated and not accessible.

 

[Theinsanegamer]

This is infuriating for many reasons but mostly for the incredible waste of food when so many are starving. How did the tech chief not put these systems on an inaccessible network from outside the intranet. These systems must be isolated and not accessible.

Obesity is the most expensive and most prevalent health condition in human history. Even in the EU more then half of adults are overweight and nearly 1 in 5 are obese. Meanwhile less then 2% are underweight. Are we really still pushing this "so many are starving" narrative?

You're assuming that the "tech chief" DIDNT make it intranet only. How do you know this? The article doesnt describe how this was done. It very well could have been an attack from a compromised VPN server, or an infected PC gaining access to the network, or various other ways. Hell given how vulnerable these systems were someone could have uploaded a worm inside one of the stores and used that to gain remote access to other systems.

 

[Mr Majestyk]

We all know the origin of this hack.

 

[scoffer]

Stupid is as stupid does.