Shortly before midnight last Sunday, the digital thermostats controlling hundreds of supermarket cold aisles across France began to flicker and rise. In a “bizarre and unprecedented” cyber-attack, hackers had remotely overridden the temperature settings on thousands of freezers, fridges and chiller cabinets pushing them from as low as -27C (-16.6F) to well over 50C (122F). Over the next four to six hours, the food inside first defrosted, then slowly began to cook.
Shop staff arriving early to restock shelves reported catching a blast of hot air, like opening an oven, when they went to fill freezers. One Normandy supermarket reported a number of its freezers had been pushed to 80C (176F). In certain stores, the extreme temperature rise had sparked fires triggering sprinklers and water damage.
Everything had to be thrown away. It was such a waste.” After removing tons of spoiled food, staff at the store worked until almost midnight on Monday to reorder and restock shelves. Dominique Schelcher, the president of Coopérative U, said 80 of its 2,000 supermarkets had been targeted.
In my entire professional career, I’ve never seen anything like it,” the shocked executive told French radio. The Paris public prosecutor’s office immediately opened an investigation into the latest in a series of cyber-attacks that have made France the most hacked country in Europe. Gérôme Billois, a partner in the cybersecurity and technology company Wavestone, said the hack had the hallmarks of political sabotage.
Most supermarket cold aisles are connected to the internet to allow remote maintenance and alerts for system failures. Initial investigations suggest the hackers disabled alarm systems before tampering with the thermostats, or extended the defrost programme by several hours to avoid triggering alarms. Danfoss said it had identified security flaws last year and had “long recommended” that customers install updates or replace obsolete unsupported systems.
The affected refrigeration units were “running outdated firmware”, it said. In the days following the first wave of attacks, France’s cyber-attack alert centre ANSSI confirmed supermarkets using controllers from two other companies were also targeted. Marta Rybczyńska, a cybersecurity specialist and researcher, said she had found previous security warnings about old supermarket freezers running out-of-date software and newer models not having firmware updated.
Extract — continue reading at the source.
