Hundreds of French supermarkets saw their refrigeration systems defrosted, spoiling tons of frozen food. The unprecedented attack has raised serious questions about food security across Europe.
Hundreds of French supermarkets were forced to throw away perishable goods on Monday after hackers commandeered refrigeration systems across the country, spoiling stock at major chains in a sophisticated overnight cyberattack.
Hackers destroyed the food by taking control of refrigeration systems at Cooperative U, Leclerc, Les Mousquetaires, and Intermarche stores across the country and then defrosting thousands of freezer and refrigeration units.
During the overnight attack, in some cases, fully-stocked fridges were heated up to 50 degrees Celsius (122 degrees Fahrenheit) for more than six hours. Over 400 stores were hit according to retailers.
Why does a supermarket refrigerator need to be able to be controlled online? Surely the day-to-day temperatures are identical year-round? I can understand the need to report temperatures, but why can they be remotely controlled at all?
I work with these controllers. Remote access is a lifesaver, makes remote diagnosis much easier, and lets us tell the client to move product before it spoils. Similar refrigeration controllera have had remote capability since the dial-up era, this isn’t a new trend.
With that said, these things need to be behind a VPN. I don’t care if the manufacturer promises their controller is safe for direct access from the internet.
It’s kinda like a factory assembly line, once these things get installed and the system is stable, the client gets allergic to any changes. I come across old control systems that have been running for 30+ years, once it’s in it’s in.
On the French news they reported that the devices affected were older and not getting security updates also that the company was foreign owned and operated.
I haven’t really seen that elsewhere, but you’re right about these obscure/old controllers becoming sacrosanct.
Probably for telemetry and monitoring
They could still broadcast their temperature (securely, hopefully), without allowing any incomming commands.
Capitalism fucks up human brains or something because you’re 100% correct and every normal engineer would agree with you. 🤷♂️
Honestly, as someone who works in an adjacent industry, anything with a thermostat inevitably gets set to a crazy value. You need something smart enough you can program it to return to normal operation after a certain amount of time.
In theory, you can get that level of control locally with a fully isolated monitoring system, but it seems silly and an unnecessary cost to have two separate systems… Until you lose your entire fridge stock to a dweeb armed with ChatGPT.
What do you mean by “crazy values”? Like measurement drift? Couldn’t that not also be reset periodically locally? Like, without a fixed isolated monitoring system but someone with a calibrated thermometer who checks the units and recalibrates them.
… Now that I’m thinking about it, don’t you need that anyway? If I’m “Mr. Fridge” sitting remote at Fridge-HQ I need an independent reading anyway so I can know whether that sensor just drifted or whether something is truely off.Also, I fully agree with your last sentence. It’s always security vs. convenience. Looks like they chose poorly.
No, like one random dude overrides the fridge setting it to 20F because he’s gonna be going in and out a lot today and he doesnt want the “fridge too warm alert” to go off. Yes, you can put a hard limit on temp ranges, but then you can’t sell it as a “fridge or freezer”, and whatever the range, at some point, someone will set it to the highest or lowest value possible for no good reason.
For HVAC it’s usually someone complains about being too warm so they set the thermostat as low as it’ll go, then forget.
So they cant be turned off remotely if the company doesnt agree with the yearly price increase.
Assuming they got a PLC controlling those fridges (or, to be fair, any kind of “smart” system), can anyone explain me why the hell were they exposed to the internet?
I understand the need for them to be controlled and programmed remotely, but like… you can just have them on an internal network not exposed to the internet? I’m not gonna defend hackers because wasting food is shitty but this was a disaster waiting to happen.
Some business major over at Fridgey Fridges Ltd. thought, ‘Ooh la la, if we add €20 worth of electronics to these things, we can sell them for an extra €500 and when they break they’ll generate an extra €100/yr in service calls and parts.’ Then some business major at the grocery co. said, ‘wow, we’re going to get fridges that can connect to the internet. Now we won’t have to have Guy go check the temperatures. (which we already don’t do) I can convince my idiot boss this saves the company €100B and get a bigger bonus this quarter.’ Then the CEO says ‘look investors, we’ve put AI in our fridges to manage the temperature,’ and the share price flew up and gave him a giant bonus.
Never underestimate the ability of business majors to think the solution to a problem, which mightn’t really exist in the first place, is to pay someone else to automate it without regard for how badly it will break after they’ve moved on.
Laziness and/or convenience. It’s always those. What supermarket would pay for an actual IT person that can setup a VPN and configure access control when “it just works” anyway.
It also acts as a reminder that this is also true for some critical infrastructure. Thankfully not all of them, but there’s been stories.
Probably step 5 of the quick start guide:
“It’s important that you connect your refrigerator to your WiFi to find out about incredible deals, product updates, and maybe once in a great while security patches!”
so many things should just not be on the internet or to me even networked. Seriously how often do you need to micromanage your fridge/freezer? These are places with plenty of employees. Having someone go through with a laser thermometer first thing in the morning and last thing at night and on some cadence through the day would be fine. You can automate the process calendar wise.
You might want to check temps remotely, recieve data about energy consumption, about issues with the freezer so you can send a technician to make repairs asap… There are several reasons to connect something like a freezer to your company’s internal network. There are absolutely zero reasons to connect the freezer to the internet.
yeah but it can all be done with good bussiness practices. If checked hourly there is plenty of time to call the hotline. Seriously we automate things with out much thought to benefit vs vulnerability. I mean if you really want to automate the whole thing then have devices that broadcast the temp to another device that collects and have it transmit it out.
i would like to know how the fuck some of them fridges got to be 50 °C. are they run on heat pumps and you can just crank them to whatever temperature with the software!? are they general purpose laboratory incubators!??!
Defrost mode. https://www.bbc.com/news/articles/crq5nzxv9q4yo
Normally, supermarket freezers go through a short period of defrosting overnight, in which temperatures rise slightly. But the hackers ordered the units to heat up and stay hot, although Danfoss did not confirm any reports about just how warm the fridges and freezers could become in that process.
Industrial controls are terrifying in terms of just how catastrophically they can cause the device to fail. Connecting machines to the internet is an incredible liability.
I once tried to beg the SCADA department to let me have a single line of sight radio transmitter for data collection. Not for control, and not even over the internet! They said no, which was the right thing to do.
Automation engineer here:
Yup, this. My cybersecurity plan for the fridges would be “what the fuck why are they exposed to any external networks for any reason?”
What horrible people.
True, but that’s still no reason to hack their supermarkets.
Who benefits from destroying supermarket products?
Same country, or a friend, that was trying to sabotage the Paris Olympics and paid guys to set rail infrastructure on fire to cause chaos.
Some big org or state actor for an attack with that dimension and target. Possibly state sponsored for political pressure or but much less likely a competing business. But they usually have less obvious ways to fight competitors. So I go with a state sponsored cyber attack.
Isn’t France going through protests at the moment? Destroying the food supply adds pressure, I don’t know enough to guess who did what.
Its not France though…the Netherlands were also hit.
Competing business
Are the fridges not working anymore ?
