Supermarket operators across France this week have had to respond to more than market forces and customers complaining about the cost of living – on Monday, hundreds of supermarket refrigerators were sabotaged by an unidentified hacker, spoiling food and causing fires across the country.
And, according to cyber-physical security firm Claroty’s Chief Technology Officer, Jason Pearce, there’s nothing unique to France in this “unprecedented” situation.
“The same type of risk exists wherever refrigeration controls are connected for remote monitoring or maintenance,” Pearce told Cyber Daily, when asked if a similar incident could happen in Australia.
“Attackers may be able to reach a central management system through exposed interfaces, weak or compromised credentials, an unpatched vulnerability, or a third-party service connection.
“They may then be able to change settings across multiple refrigeration circuits without accessing each fridge individually.”
One interesting aspect of the French incident is how different companies found out about the incident, Pearce said. Some stores only found out when they noted spoiled food the next day, and while Danfoss systems were widely reported as one point of compromise, other systems were also impacted.
“In a separately reported incident involving Dixell equipment, monitoring detected an abnormal temperature rise at about 4 am; store staff and refrigeration specialists responded and stopped the attack before food had to be discarded,” Pearce said.
And while the incident is rightly causing consternation in France, with supermarket operators, law enforcement, and even the country’s Prime Minister actively engaged, in Australia’s remote regions the impact could be even worse.
“The potential consequences here could be sharper in places with fewer supermarkets, longer resupply times or limited alternative cold storage,” Pearce said.
An outage at a regional distribution centre or a key cold-chain facility could affect a wider catchment than an outage at one urban store. That’s a resilience scenario operators should plan for, rather than a prediction that it will happen.”
To keep Australian fridges safely stocked and secure, Pearce said there are several steps supermarket operators should be taking.
“Start by confirming what refrigeration controllers and remote-management systems are installed across stores and distribution sites, who owns them, and whether any are end-of-life, unpatched or directly exposed to the internet,” Pearce said.
“Then verify that supplier access is restricted to named, authorised users, strongly authenticated, time-limited and logged.”
Operators should also be monitoring operation behaviour, as well the wider network, for suspicious activity, and have proper alerts in place if anything is detected.
“A temperature rising unexpectedly, a setpoint changing outside an approved maintenance window, or defrost settings being altered rapidly should generate an alert to people who can act – not just a dashboard entry,” Pearce said.
“The store team and refrigeration provider should know who receives that alert, including overnight.”
And if something does occur, having a well-rehearsed action plan in the company’s response playbook is essential to knowing when and how to react.
“Operators need a rehearsed way to confirm whether the temperature reading is real, stop unauthorised remote changes, involve refrigeration technicians and assess the food-safety implications,” Pearce said.
“They should also know how to preserve local control, restore known-good settings and keep supply moving if refrigeration at one site has to be isolated.”
Claroty has some form in this area, with its Team82 identifying vulnerabilities in Danfoss AK-SM 800A controllers in August, after which it worked through disclosure with the vendor. Issued fixes and a firmware update released, according to Pearce, but the recent incident occurred nonetheless.
“That demonstrates why patching where available and secure remote access matter,’ Pearce said, though he noted this does not prove those specific vulnerabilities were used in every French incident. Investigators have not publicly confirmed the precise entry method.
The bottom line, Pearce contends, however, is that food resilience is about more than keeping shelves stocked – those shelves need to be secure, as well.
“It also depends on the refrigeration, monitoring, remote maintenance and supplier systems that keep that stock safe,” Pearce said.
“Operators should be able to see those dependencies, detect unsafe changes quickly and recover without waiting for the next morning’s store opening.”
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
