A supermarket’s refrigerators are supposed to keep food fresh, but a series of cyberattacks in Europe over the past two months has shown how the gadgets can be turned into a weapon against the businesses operating them.
In October, hackers remotely manipulated refrigeration systems in hundreds of supermarkets and independent stores across France, raising temperatures in freezers and cold rooms to levels that ruined food.
The attacks have since spread in successive waves across Europe, with supermarkets in Belgium, Sweden, Luxembourg, Finland, Ireland and Estonia reporting similar disruptions.
In one incident in Sweden, a supermarket manager told the Reuters news agency that the store’s freezers had reached 50 degrees Celsius. The attack had occurred overnight but was only discovered hours later, by which time the stock had been compromised.
The incidents illustrate a growing cybersecurity problem as businesses connect more of their physical infrastructure to the internet.
For supermarkets, this means refrigeration systems can be managed across several outlets without technicians having to visit each store.
But if the digital controllers are poorly protected, this remote access can give hackers the ability to interfere with the equipment.
Supermarkets’ commercial refrigeration installations have centralised digital controllers that regulate temperatures, manage compressors, initiate automatic defrost cycles, monitor faults and trigger alarms when something goes wrong.
These systems are often connected to the internet so supermarket operators and refrigeration contractors can monitor equipment, identify faults and change settings remotely.
The convenience turns risky when controllers are directly exposed to the public internet or protected by weak passwords.
Researchers say several weaknesses have made these systems vulnerable, including outdated software, manufacturer-default passwords, shared login credentials and poor control over remote access.
A study by US-based cybersecurity firm Forescout last month identified 12,976 refrigeration management services accessible online across 99 countries and territories, 80 percent of which were running firmware older than the version that addressed known security flaws.
In the wake of the recent Europe attacks, Laurens Singier, an ethical hacker and researcher at Howest University of Applied Sciences in Belgium, told Reuters that the problem was partly caused by the exposure of industrial devices to the public internet.
“In this case, the weak point was mainly putting those devices on the public internet. They shouldn’t even be there,” he said.
OT includes systems controlling electricity generation and distribution, water treatment, manufacturing machinery, transport infrastructure, hospital equipment and industrial heating and cooling.
A successful attack on these systems can therefore cause physical damage, interrupt essential services, destroy products and, in some cases, put public safety at risk.
Similar weaknesses in hospital refrigeration systems, for instance, could affect the storage of medicines, vaccines and blood supplies, while attacks on industrial cooling equipment could disrupt manufacturing and food processing.
The European incidents are therefore a warning to businesses that the cybersecurity risks associated with connected devices are not confined to computers, mobile phones and corporate databases.
As the Internet of Things (IoT) expands, more equipment is being fitted with sensors, software and internet connectivity to improve efficiency, enable remote monitoring and reduce maintenance costs.
To be safe, experts say companies need to replace default and shared passwords with individual accounts, introduce multi-factor authentication where possible and regularly update software and firmware.
Equipment that has reached the end of its support life and no longer receives security updates should be upgraded or isolated from exposed networks.
They also recommend separating operational technology from ordinary office networks to limit the possibility that an attacker who gains access to an employee’s computer can move freely into systems controlling physical equipment.
Businesses should also monitor remote access and changes to equipment settings, with clear responsibility assigned to internal IT teams, suppliers and contractors.
The UK’s National Cyber Security Centre has urged businesses to update software on fridge temperature controls, while affected retailers have been disconnecting vulnerable systems and working with suppliers to secure them.
For Kenyan businesses, this is an eye-opener as retailers, manufacturers, hospitals and other organisations adopt more connected equipment to manage operations.
The growth of smart buildings, automated production systems, connected security devices and digital monitoring tools requires organisations to treat these devices as part of their cybersecurity responsibilities.
