Whether it was youngsters proving their skills or state sabotage, Europe’s most hacked country was left with a mountain of waste after food began cooking in freezers

The intitial investigation is in.

In a “bizarre and unprecedented” cyber-attack, hackers had remotely overridden the temperature settings on thousands of freezers, fridges and chiller cabinets pushing them from as low as -27C (-16.6F) to well over 50C (122F).

If shop managers first assumed it was an isolated failure, it soon became clear up to 700 stores – including those from the Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix chains along with a number of smaller independent shops – had been victims of a cyber-attack.

The hackers had pirated the controllers supplied by the Danish company Danfoss that controls the freezers and fridges. Most supermarket cold aisles are connected to the internet to allow remote maintenance and alerts for system failures. Initial investigations suggest the hackers disabled alarm systems before tampering with the thermostats, or extended the defrost programme by several hours to avoid triggering alarms.

Danfoss said it had identified security flaws last year and had “long recommended” that customers install updates or replace obsolete unsupported systems. The affected refrigeration units were “running outdated firmware”, it said. In the days following the first wave of attacks, France’s cyber-attack alert centre ANSSI confirmed supermarkets using controllers from two other companies were also targeted.

  • HaraldvonBlauzahn@feddit.orgEnglish
    2·
    11 hours ago

    I agree that using a VPN is much more secure. And together with not allowing remote temperature control, this would have prevented this specific issue.

    Still, if you have a VPN in a large supermarket chain, you need to manage the access keys - in a way that when one user of the VPN quits the organization, their access is revoked.

    And also, it isnot a good idea that many people share passwords to devices which give administrative rights. So, you should give a unique password to every user, similar as every guest in a hotel gets an NFC card with a unique code.

    The best way I know of to do that would be a PKI and smart cards. This also prevents users from using dumb passwords or using the same ones in multiple places.

    But my impression is that very few organizations like supermarkets do that.

    It gets even more complex with the modern rush to outsource every little thing.