On the night of October 11 to 12, cybercriminals took control of the refrigeration systems of hundreds of supermarkets in France. Temperatures in refrigerators and freezers have risen to 50 degrees Celsius, spoiling food and even causing fires in several establishments. Three weeks later, on Monday, November 2, several supermarkets in Sweden, Belgium, Luxembourg and Estonia also reported freezer and refrigerator failures that appeared to stem from a cyber attack. There were also cases in stores in Ireland, the Netherlands and Finland.
Given all this, only a few questions come to mind: What the hell is going on? Who is behind everything? Did we really need attached refrigerators in supermarkets?
Damaged shops. Several retailers have reported to various media that at least 350 supermarkets were involved in the cyber attack. As of Time, Intermarché and Netto already have 180 stores, Cooperative U at least 100 and Carrefour 80. Intermarche CEO Thierry Cotillard told local media BFM-TV that losses totaled ten million euros across the country in one day. Prosecutors in Paris launched an investigation and Prime Minister Sébastien Lecornu asked France’s national cyber security agency to investigate.
From that point we go to this same Monday, November 2, a wave that has invaded supermarkets in more countries. In this case, the Ahold Delhaize and Colruyt chains reported affecting refrigerators and freezers in dozens of stores in Belgium and Luxembourg, as well as Swedish chains ICA and Coop. Carrefour Belgium also claimed 15 of its more than 700 stores were affected, and Sweden’s Koop said 7 of its stores were affected. Later reports also point to its stores in Germany, Portugal, Romania and Italy.
Defrosting. According to BFM-TV, the attackers forced the cooling systems into a continuous defrost cycle. Le Monde reported that they extended the defrost time on some units from one hour to eight, which delayed the alarm. In Belgium, the CEO of the installation company Subkobel said the unit’s evaporators were switched to defrost mode.
weak point. The common thread is the software that manages the refrigeration units, as the French cyber security agency, ANSSI, said the attack in the country affected AK-SC and AK-SM, two refrigeration management systems from the Danish company Danfoss. The company indicated that the affected units were running outdated firmware. Time also noted that in August security firm Clarotti released research showing flaws in Danfoss controllers that could allow an intruder to bypass logins.
The company updated its management system’s firmware, but Reuters noted that Danfoss units were also involved on Nov. 2.
Patrick Lampelmeier, technology director at cybersecurity company Tributeque, told Gizmodo that thousands of controllers were still accessible from the Internet after the attack in France. “There is no information to steal and no ransom to negotiate,” he told the outlet, adding that only a few commandos were able to empty the store’s stock overnight.
That’s where AI comes in. Nothing published so far proves that AI was used in these attacks. The Belgian Cyber Security Center said they don’t know who is behind them and the culprit will never be known. Its spokeswoman, Katrin Eggers, told Reuters she was concerned about AI because, in her view, it makes it easier for cyber attackers to exploit system vulnerabilities.
The UK’s National Cyber Security Center expects AI-powered malware to be used in ransomware attacks against the country’s critical infrastructure by 2028. Its director, Richard Horne, aptly names the heating and cooling systems that drive the physical processes on which society depends, noting how easy it is to invade France.
Not just supermarkets. From the research department of the company Forescout they found 12,976 cooling services exposed on the Internet at 6,017 public IP addresses in 99 countries. The company warns that the risk extends to refrigeration equipment in hospitals and agricultural centers, as well as pharmaceutical storage systems, food processing plants or warehouses, so if someone gained access to these exposed systems, it would cause significant damage to critical infrastructure.
Attached refrigerator. Supermarkets connect their units so that maintenance and monitoring can be done remotely. TIME describes central control panels, often connected to the Internet so maintenance companies can access them. The problem is that if someone outside the company illegally accessed these controls, that’s exactly what happened in recent weeks at the aforementioned supermarkets.
Exposing a management interface directly to the Internet is something that should not happen. Even ANSSI has been particularly critical of this issue, because if remote access is required, the agency recommends limiting it to trusted IP addresses. And the thing is, this is not new because, a few years ago, TechCrunch reported that researcher Noam Rotem found thousands of industrial refrigerators displayed online and that they could be unlocked with a default password from the manufacturer’s own documentation. Wow, anyone who wants to do harm will be able to do so, especially considering the weak security infrastructure upon which many critical systems for society are founded.
Cover image Sandra Tan
In Xataka | OpenAI has discovered that its AI agents have found a way to secretly talk to each other
