French fridge hacks expose cold truth about a growing systemic risk to global supply chains

Hackers seized control of refrigeration systems at French supermarkets and raised temperatures so high that fires broke out and food was spoiled.

Although the French National Cybersecurity Agency (ANSSI) has identified a vulnerability in software supplied by a manufacturer whose systems were involved in the attack, it is not yet known how threat actors commandeered the devices.

Just two months ago, researchers at Claroty's Team82 uncovered vulnerabilities in refrigeration controllers from the same company that could enable authentication bypass, remote code execution and denial-of-service attacks.

However, the firm itself put the incident down to outdated firmware in impacted chilling units, effectively blaming it on a failure to update.

This "unprecedented" attack is expected to cost the wider food industry tens of millions of euros.

But it doesn't take much imagination to envisage far more severe consequences from attacks or failures big enough to trigger cascading supply-chain disruption, causing anything from sudden price shocks to widespread food shortages and mass starvation.

Amir Preminger, CTO at Claroty, said: "For threat actors seeking to disrupt critical operations, refrigeration controllers are a prime target that often go overlooked by security teams. Even nation-state actors have targeted refrigeration controllers to wreak havoc on geopolitical adversaries.

"This cyber attack should raise the alarm for any company that is responsible for handling temperature-sensitive products.

"Industrial control systems such as refrigeration controllers are often assumed to be on safely isolated networks, however, our research found many of these devices are directly exposed to the public internet."

"Unprecedented"

The scale of the French cyberattack was massive.

Hackers targeted at least 255 supermarkets across France, remotely raising the temperature of refrigerators and freezers to as high as 50°C (122°F), causing fires and destroying food.

One retailer said 150 of its stores were affected, another reported attacks on 80 supermarkets, and a third said 5% of just under 500 stores were targeted. At least 255 stores were therefore affected across these three groups alone.

Security researchers also reported incidents in Spain, Portugal, Poland, Germany and Belgium, although they did not establish the scale of disruption in those countries.

READ MORE: “Psychological warfare”: ASOS hackers use push notifications to deliver fear to the front door

The attack highlights our dependence on complex global food supply systems, and the fragility and vulnerability of operational technology at the heart of supply chains so important they should be treated as critical infrastructure.

Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, said, “These are the same category of systems that the security industry has been warning about as the next frontier for sabotage attacks, and they’ve now been weaponised against food retail infrastructure in one of Europe’s largest economies."

Who's to blame?

Right now, we don't know exactly what happened. There's no ransom note - yet - or data leaks indicating the hackers followed up on a previous threat.

But Tom Hegel, Distinguished Threat Researcher and Research Lead at SentinelOne, said the attacks resemble the "low-cost, deniable sabotage" Europe has dealt with for years involving undersea cable cutting, warehouse fires or GPS jamming, typically blamed (albeit unreliably) on Moscow.

Hegel predicted more attacks on refrigeration systems as they "hurt very quickly and very publicly", particularly because retail is an "incredibly easy target".

He said: "We saw a similar pattern at US military commissaries in August, when freezers on several bases failed within a day of each other and military investigators opened cases.

"We can’t say the two incidents are linked. What they share is the target: refrigeration controllers that sit on the internet, often running old firmware with publicly known security vulnerabilities.

"That’s also why attribution is so hard here. An attacker who logs into an exposed control panel leaves almost nothing behind, with no malware to analyze and few clues beyond an IP address that probably leads to a rented server. A teenager and an intelligence service would look much the same from the defender’s side."

Systemic risk factors

Humanity is frighteningly dependent on refrigeration technology. According to the World Bank, at least 25% of food produced in developing countries is lost because of inadequate "cold-chain infrastructure".

The United Nations estimates that insufficient refrigeration contributes to the loss of 526 million tonnes of food annually, equivalent to 12% of global production and enough to feed about one billion people.

This dependency is part of the reason refrigeration systems represent such a classic systemic risk.

They are produced in a market where a relatively small number of manufacturers dominate some sectors, meaning vulnerabilities can potentially be exploited at scale.

They also depend on aging infrastructure running outdated software, are being carelessly connected to the internet, and keep billions of people alive - making their security profoundly important to our species.

Samuel Hassine, CEO and co-founder of Filigran, said: "Refrigeration controllers, building systems and point-of-sale equipment are now connected and remotely managed, often through a handful of suppliers, so one weak link scales to hundreds of stores overnight."

James Neilson, SVP of Global at OPSWAT, added: "The interconnected nature of retail means one compromised supplier system can hit multiple supermarket chains nationwide. When a remote management layer controls a physical process, it becomes a single point of failure for an entire retail estate."

A chilling security threat

We should probably get used to seeing attacks on OT devices sitting directly on the public internet - because they're insecure and companies forget to lock them down.

Denis Calderone, CTO at Suzu Labs, said: “These refrigeration controllers often have default credentials or no meaningful authentication at all. Some units also have a documented 'code-of-the-day' bypass that takes advantage of a predictable code that can be trivially calculated to gain access."

So who's really to blame, threat actors or the companies that fail to update their systems?

Damon Small, Board of Directors at Xcape, Inc., said: "Operators must be held accountable for maintaining poorly configured environments. Accountability cannot be entirely outsourced.

"If a criminal breaks into a house because the owner left the front door wide open, the owner shares part of the blame.

"To mitigate this exposure, security teams must immediately sever control interfaces from the public Internet, place maintenance access behind segmented networks requiring multifactor authentication, and apply long-available updates.”

READ MORE: Five Eyes exposes Chinese hacking network as researchers warn of AI cyberwar arms race

European regulators are stepping in to address the problem, introducing relevant rules that could help stop a dangerous defrosting down the line.

Josh Marpet, Senior Product Security Consultant at Finite State, said: “The EU Cyber Resilience Act has a significant end-of-support model that is intended for exactly this scenario. Under the EU CRA, end of support is not a set time, such as 1 or 5 years.

"It is minimally 5 years, and as long as the expected lifetime of the product is. Under this, if the refrigeration systems are expected to last 20 years, support and security patches must continue for 20 years. Food safety is critical infrastructure, and the consequences of issues can be sickness or even death.”

Big security spending

The growing vulnerability of food supply systems is obviously very bad for humanity.

Which means, of course, there's almost certainly lots of money coming the security industry's way as leaders move to fix a problem they put off addressing until it became a full-blown fire emoji.

Susannah Streeter, Chief Investment Strategist at Wealth Club, predicted a wave of spending as corporate defenses start to look "dangerously thin amid an onslaught of cyberattacks against businesses".

"The scale of the threat is staggering, with Gartner forecasting that global spending on information security will reach $248.9 billion this year, while Cybersecurity Ventures has estimated that cybercrime costs have expanded to $10.8 trillion annually," she said.

"The amount being spent on protection is surging, with forecasts that there will be a much bigger shift away from reactive detection and response strategies towards pre-emptive solutions, reliant on advanced AI tools. It demonstrates the considerable opportunities ahead as businesses strengthen their defenses."

The attacks also show where the industry should focus its attention, said John Strand, Owner, Black Hills Information Security.

He told Machine: "This is exactly the type of story we need to be thinking about. We still focus too much on protecting endpoints, servers, and web applications. All of that is important. But I think some of the biggest damage we’re going to see will involve IoT devices.

“These devices don’t get regular patches. They don’t get advanced EDR. Many times, they don’t even get simple firewalls because they’re installed in mom-and-pop convenience stores all over Europe and the United States. I don’t think we, as a society, are ready for that.

“Corporations take responsibility for protecting their employees, their systems, and their data. But when somebody builds a connected refrigerator, we tend to look at it as a product rather than an enterprise asset.

"Once it’s sold, the expectation is that the shop that owns it is responsible for securing it.

"And a lot of those shops have zero information security practice."

Which means - as with so many threats to our critical systems - that we'll probably only start to address it once the serious damage has been done.

Follow Machine on LinkedIn