Chains in Sweden, Belgium and Luxembourg say fridge temperatures rose overnight, similar to hack of French stores
Supermarket chains in Sweden, Belgium and Luxembourg have said the temperatures of their refrigerators and freezers in dozens of stores rose overnight, prompting fears of a cyber-attack similar to one that caused millions of euros of food losses in France.
Sweden’s Coop chain told the daily Aftonbladet on Monday that six of its stores had been affected, while ICA said it was “aware that a limited number of stores were affected by an incident overnight which impacted their refrigeration and freezer systems”.
Why these on network with outside access?
Because stupid. There’s zero reason for them to be on the public internet beyond incompetent operational IT security.
Exactly ; the concept itself is the real flaw.
In theory they gather all sorts of data so they can see how efficiently they’re running, whether maintenance is needed. If something goes wrong with one of the units they can dispatch a repair guy immediately, or have the store shift the food before any spoilage. If they’re smart about it they can use the data to set up an efficient preventative maintenance schedule and really stay on top of things.
A chain that has 500 stores with 20 units a piece adds up fast. They probably have a person at headquarters whose only job it is to stay on top of these units.
You do that with your own internal network or, at max, with a vpn. You don’t need them to connect to the internet at all.
No reason not to connect to the internet. Put the units on their own VLAN and firewall that off from anything but the IP of the monitoring end. Plenty of other ways to make this secure, that one’s off the top of my head.
Exactly why do you need to do this instead of just keeping everything out of the internet and then connecting through a vpn tunnel?
If you need to monitor these 24/7 for some reason, pay a department that works 24/7 locally. Otherwise is just half-assing solution that will end like this sooner than later.
No reason at all to connect any kind of sensitive machinery to the internet, especially if remote operation of it can cause harm or damages.
That one’s not very secure.
Yup, absolutely correct.
Automation engineer here, this is 100% a problem with their network model