Supermarket shelves in France were left empty earlier this week after a cyberattack disabled the refrigeration systems in around 300 stores. As a result, fridges and freezers overheated, sometimes reaching up to 50°C, spoiling kilos of meat, dairy products, and frozen foods, all of which had to be thrown away. While there is no threat to food supply, the incident highlighted just how quickly criminals can gain access to internet-connected devices.
According to Alexandre Dulaunoy, Director of the Computer Incident Response Centre Luxembourg (CIRCL), the problem often lies with weak passwords. He warns that if equipment is not properly secured, an attacker can gain access to modify data and more. In the French case, it mainly came down to easy-to-guess passwords and certain vulnerabilities in the available equipment.
Carlo Harpes, Director of itrust consulting, says supermarkets usually lack the expertise to manage complex appliances themselves. He explains that when a supermarket buys a fridge, it sometimes needs someone else to monitor and maintain it, usually through another company. If that company manages thousands of fridges, it becomes a much more attractive target for hackers.
In the French attack, the Danish company Danfoss was affected, and experts believe security gaps played a crucial role. Many businesses, Harpes says, fail to recognise these risks in the first place, making them even more vulnerable.
Harpes advises taking three key steps: first, do not connect such systems directly to the internet; second, only allow external suppliers access when necessary, rather than granting permanent access; and third, keep track of and phase out outdated equipment, which is often still in use for economic reasons, even if it should have been retired years ago. Harpes stresses that old systems should not be neglected just because they are still functioning.
CIRCL regularly examines equipment and systems for IT weaknesses. Dulaunoy points out that hackers often exchange information in online groups, such as on Telegram, to prepare attacks in advance. He explains that they try to be proactive, observe what they are doing, and identify which types of equipment or targets are at risk. This way, new vulnerabilities in hardware or software can be discovered before they are exploited.
To help companies and organisations better understand and prepare for such threats, the government agency organises the annual hack.lu conference. This year’s event will take place from 20 to 23 October, providing a platform for private companies and other organisations to learn about cyber risks and defence strategies.
