Cyberattack Disrupts Food Supply Chain at French Supermarkets
In a significant cybersecurity breach, numerous internet-connected refrigerators at French supermarkets have been compromised, leading to the spoiling of vast quantities of perishable goods over the past weekend. The French Computer Emergency Response Team (CERT-FR) has issued warnings and guidelines to help mitigate the damage and prevent future incidents.
Initially, CERT-FR identified specific refrigeration controllers from Danfoss, known as the AK-SC and AK-SM series, as key components affected by the attack. Supermarkets were urged to disconnect any refrigeration control systems that had public IP addresses from the internet. This step is crucial to prevent further exploitation while they verify their configurations. The recommendation includes reconnecting these systems only through secure Virtual Private Networks (VPNs) after restoring factory settings if necessary. In urgent scenarios, supermarkets have been advised to filter connections to permit access solely from their refrigeration suppliers or service providers, although CERT-FR warns that this should not be a long-term solution.
One of the supermarket chains most significantly impacted was Groupement Mousquetaires, which operates under the well-known Intermarché and Netto brands. In the wake of the attack, the chain swiftly removed products from display units overseeing fresh and frozen foods that were controlled by the affected Danfoss systems. A spokesperson confirmed that these actions aimed at safeguarding consumer health and minimizing loss.
In an eerie foreshadowing of the event, Dixell, a French control systems vendor, had shared a post on LinkedIn emphasizing the importance of cybersecurity for everyone, stating, "Cybersecurity is everyone’s business, all the time. Today, our competitors were targeted; tomorrow, it could be our turn." This turned out to be prophetic, as the impending attack materialized, affecting a wider range of systems than initially anticipated.
As the situation spiraled, it became evident that additional models of refrigeration controllers from other manufacturers, specifically those sold under the Dixell and Copeland brands, were also compromised. In response, Dixell issued a security advisory urging users of its XWEB internet interface to upgrade systems running older versions and implement stronger password protocols. The advisory echoed CERT-FR’s advice and highlighted the importance of securing remote access through various means, including VPNs or dedicated mobile connections. In emergency situations, the implementation of IP address filters was also advised.
Tom Hegel, the research lead at SentinelOne, a cybersecurity monitoring firm, highlighted the ongoing risks associated with exposed control systems. He noted that the breaches could continue as long as thousands of these interfaces remain accessible online. Many supermarkets currently purchase "refrigeration as a service," wherein service providers guarantee performance and traceability of the cold chain, necessitating constant data access.
Historically, the security of legacy operational technology (OT), like those involved in supermarket refrigeration, has often been overlooked by Chief Information Security Officers (CISOs). Hegel pointed out that retail chains manage substantial estates of refrigeration controllers, building management systems, and various other technologies without adequate security integration. Often, these installations are carried out by facilities contractors who don’t engage security teams in their processes, leading to vulnerabilities.
As supermarket CISOs scramble to assess and secure their systems, they are left grappling with critical questions: Who was behind the attack? What were their motives? The complexity of identifying the perpetrators is exacerbated by the nature of the attack itself. Hegel explained that a hacker accessing an exposed control panel leaves minimal evidence of their presence, making it challenging to pinpoint the source of the breach. "An attacker who logs into an exposed control panel leaves almost nothing behind, with no malware to analyze and few clues beyond an IP address that probably leads to a rented server. A teenager and an intelligence service would look much the same from the defender’s side," he remarked.
The nuances between a mere nuisance and a serious incident hinge on the degree of control that has been exposed to the internet. As supermarkets work to fortify their defenses and enhance their cybersecurity protocols, the repercussions of this incident demonstrate the vital importance of safeguarding sensitive operational technologies against increasingly sophisticated cyber threats. The implications of such attacks extend far beyond immediate financial losses, potentially jeopardizing food safety and consumer trust in the long term.