Hundreds of French supermarkets saw their refrigeration systems defrosted, spoiling tons of frozen food. The unprecedented attack has raised serious questions about food security across Europe.
Hundreds of French supermarkets were forced to throw away perishable goods on Monday after hackers commandeered refrigeration systems across the country, spoiling stock at major chains in a sophisticated overnight cyberattack.
Hackers destroyed the food by taking control of refrigeration systems at Cooperative U, Leclerc, Les Mousquetaires, and Intermarche stores across the country and then defrosting thousands of freezer and refrigeration units.
During the overnight attack, in some cases, fully-stocked fridges were heated up to 50 degrees Celsius (122 degrees Fahrenheit) for more than six hours. Over 400 stores were hit according to retailers.
Assuming they got a PLC controlling those fridges (or, to be fair, any kind of “smart” system), can anyone explain me why the hell were they exposed to the internet?
I understand the need for them to be controlled and programmed remotely, but like… you can just have them on an internal network not exposed to the internet? I’m not gonna defend hackers because wasting food is shitty but this was a disaster waiting to happen.
Laziness and/or convenience. It’s always those. What supermarket would pay for an actual IT person that can setup a VPN and configure access control when “it just works” anyway.
It also acts as a reminder that this is also true for some critical infrastructure. Thankfully not all of them, but there’s been stories.
Probably step 5 of the quick start guide:
“It’s important that you connect your refrigerator to your WiFi to find out about incredible deals, product updates, and maybe once in a great while security patches!”
Some business major over at Fridgey Fridges Ltd. thought, ‘Ooh la la, if we add €20 worth of electronics to these things, we can sell them for an extra €500 and when they break they’ll generate an extra €100/yr in service calls and parts.’ Then some business major at the grocery co. said, ‘wow, we’re going to get fridges that can connect to the internet. Now we won’t have to have Guy go check the temperatures. (which we already don’t do) I can convince my idiot boss this saves the company €100B and get a bigger bonus this quarter.’ Then the CEO says ‘look investors, we’ve put AI in our fridges to manage the temperature,’ and the share price flew up and gave him a giant bonus.
Never underestimate the ability of business majors to think the solution to a problem, which mightn’t really exist in the first place, is to pay someone else to automate it without regard for how badly it will break after they’ve moved on.
so many things should just not be on the internet or to me even networked. Seriously how often do you need to micromanage your fridge/freezer? These are places with plenty of employees. Having someone go through with a laser thermometer first thing in the morning and last thing at night and on some cadence through the day would be fine. You can automate the process calendar wise.
You might want to check temps remotely, recieve data about energy consumption, about issues with the freezer so you can send a technician to make repairs asap… There are several reasons to connect something like a freezer to your company’s internal network. There are absolutely zero reasons to connect the freezer to the internet.
yeah but it can all be done with good bussiness practices. If checked hourly there is plenty of time to call the hotline. Seriously we automate things with out much thought to benefit vs vulnerability. I mean if you really want to automate the whole thing then have devices that broadcast the temp to another device that collects and have it transmit it out.