Hundreds of French supermarkets saw their refrigeration systems defrosted, spoiling tons of frozen food. The unprecedented attack has raised serious questions about food security across Europe.
Hundreds of French supermarkets were forced to throw away perishable goods on Monday after hackers commandeered refrigeration systems across the country, spoiling stock at major chains in a sophisticated overnight cyberattack.
Hackers destroyed the food by taking control of refrigeration systems at Cooperative U, Leclerc, Les Mousquetaires, and Intermarche stores across the country and then defrosting thousands of freezer and refrigeration units.
During the overnight attack, in some cases, fully-stocked fridges were heated up to 50 degrees Celsius (122 degrees Fahrenheit) for more than six hours. Over 400 stores were hit according to retailers.
Why does a supermarket refrigerator need to be able to be controlled online? Surely the day-to-day temperatures are identical year-round? I can understand the need to report temperatures, but why can they be remotely controlled at all?
I work with these controllers. Remote access is a lifesaver, makes remote diagnosis much easier, and lets us tell the client to move product before it spoils. Similar refrigeration controllera have had remote capability since the dial-up era, this isn’t a new trend.
With that said, these things need to be behind a VPN. I don’t care if the manufacturer promises their controller is safe for direct access from the internet.
It’s kinda like a factory assembly line, once these things get installed and the system is stable, the client gets allergic to any changes. I come across old control systems that have been running for 30+ years, once it’s in it’s in.
On the French news they reported that the devices affected were older and not getting security updates also that the company was foreign owned and operated.
I haven’t really seen that elsewhere, but you’re right about these obscure/old controllers becoming sacrosanct.
Probably for telemetry and monitoring
They could still broadcast their temperature (securely, hopefully), without allowing any incomming commands.
Capitalism fucks up human brains or something because you’re 100% correct and every normal engineer would agree with you. 🤷♂️
Assuming they got a PLC controlling those fridges (or, to be fair, any kind of “smart” system), can anyone explain me why the hell were they exposed to the internet?
I understand the need for them to be controlled and programmed remotely, but like… you can just have them on an internal network not exposed to the internet? I’m not gonna defend hackers because wasting food is shitty but this was a disaster waiting to happen.
Laziness and/or convenience. It’s always those. What supermarket would pay for an actual IT person that can setup a VPN and configure access control when “it just works” anyway.
It also acts as a reminder that this is also true for some critical infrastructure. Thankfully not all of them, but there’s been stories.
Probably step 5 of the quick start guide:
“It’s important that you connect your refrigerator to your WiFi to find out about incredible deals, product updates, and maybe once in a great while security patches!”
Some business major over at Fridgey Fridges Ltd. thought, ‘Ooh la la, if we add €20 worth of electronics to these things, we can sell them for an extra €500 and when they break they’ll generate an extra €100/yr in service calls and parts.’ Then some business major at the grocery co. said, ‘wow, we’re going to get fridges that can connect to the internet. Now we won’t have to have Guy go check the temperatures. (which we already don’t do) I can convince my idiot boss this saves the company €100B and get a bigger bonus this quarter.’ Then the CEO says ‘look investors, we’ve put AI in our fridges to manage the temperature,’ and the share price flew up and gave him a giant bonus.
Never underestimate the ability of business majors to think the solution to a problem, which mightn’t really exist in the first place, is to pay someone else to automate it without regard for how badly it will break after they’ve moved on.
so many things should just not be on the internet or to me even networked. Seriously how often do you need to micromanage your fridge/freezer? These are places with plenty of employees. Having someone go through with a laser thermometer first thing in the morning and last thing at night and on some cadence through the day would be fine. You can automate the process calendar wise.
You might want to check temps remotely, recieve data about energy consumption, about issues with the freezer so you can send a technician to make repairs asap… There are several reasons to connect something like a freezer to your company’s internal network. There are absolutely zero reasons to connect the freezer to the internet.
yeah but it can all be done with good bussiness practices. If checked hourly there is plenty of time to call the hotline. Seriously we automate things with out much thought to benefit vs vulnerability. I mean if you really want to automate the whole thing then have devices that broadcast the temp to another device that collects and have it transmit it out.
i would like to know how the fuck some of them fridges got to be 50 °C. are they run on heat pumps and you can just crank them to whatever temperature with the software!? are they general purpose laboratory incubators!??!
What horrible people.
Who benefits from destroying supermarket products?
Same country, or a friend, that was trying to sabotage the Paris Olympics and paid guys to set rail infrastructure on fire to cause chaos.
Isn’t France going through protests at the moment? Destroying the food supply adds pressure, I don’t know enough to guess who did what.
Its not France though…the Netherlands were also hit.
Some big org or state actor for an attack with that dimension and target. Possibly state sponsored for political pressure or but much less likely a competing business. But they usually have less obvious ways to fight competitors. So I go with a state sponsored cyber attack.
Competing business
Are the fridges not working anymore ?
