The intitial investigation is in.
In a “bizarre and unprecedented” cyber-attack, hackers had remotely overridden the temperature settings on thousands of freezers, fridges and chiller cabinets pushing them from as low as -27C (-16.6F) to well over 50C (122F).
If shop managers first assumed it was an isolated failure, it soon became clear up to 700 stores – including those from the Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix chains along with a number of smaller independent shops – had been victims of a cyber-attack.
The hackers had pirated the controllers supplied by the Danish company Danfoss that controls the freezers and fridges. Most supermarket cold aisles are connected to the internet to allow remote maintenance and alerts for system failures. Initial investigations suggest the hackers disabled alarm systems before tampering with the thermostats, or extended the defrost programme by several hours to avoid triggering alarms.
Danfoss said it had identified security flaws last year and had “long recommended” that customers install updates or replace obsolete unsupported systems. The affected refrigeration units were “running outdated firmware”, it said. In the days following the first wave of attacks, France’s cyber-attack alert centre ANSSI confirmed supermarkets using controllers from two other companies were also targeted.
These are actually a good place to have a network connection. Can you imagine having to be the person who’s jod it is to walk to all of the fridges in the store and just check if they are at the right temp… every X minutes? After doing it for weeks, you probably wouldn’t even notice the one that is wrong.
Yeah but put it on a private network, not the internet
See I was thinking that at first too. But then the supermarket has to host the software to manage the devices. If it were just fridges, fine, but surely it is a ton of things, all with their own software… so letting the fridge talk directly to the companies servers saves the supermarket from needing to have serious IT staff.
Now there are a ton of ways to make it a safer connection so that it can’t be hacked so easily. From the sounds of things, even that was too much for the supermarket people to do. So default password it was.
You’re probably young, but there used to be that job.
And that became obsolete by infranet connections. You know, a local computer not connected to the internet.
Not young. Worked at a supermarket before the internet (technically it existed, but not in supermarkets and such. It was the very early dial up days… pre AOL and such. Anyway, the one manager hated me, and he would have given me that job if it existed. I got along with my coworkers. None of them had that job. Maybe the night time restockers checked once a night or something, I didn’t know all of them. But I don’t so. They just waited for a customer to tell them I believe. But back then, a freezer full wasn’t as big a loss as it is nowadays. And their margins were higher.