A series of renewed cyber attacks on retail refrigeration systems across has set alarm bells ringing across Europe, with reports of temperatures in some freezer units rising as high as 50° Centigrade, causing ruined food to have to be dumped.
Although on a smaller scale, the latest incidents that took place across multiple countries are all strongly reminiscent of a serious incident that took place in France in October, which affected hundreds of branches of multiple supermarket chains, and come days after it emerged the US authorities are investigating a series of similar attacks that targeted freezers at American military bases.
In Ireland, Musgrave, which backs the nationwide Supervalu chain, confirmed that a small number of stores had been impacted by an incident targeting certain refrigeration equipment models.
The organisation told the media that its monitoring systems detected the incident early and said it pulled some chilled and frozen product lines as a precaution. A spokesperson said the situation was now returning to normal and it was working with suppliers and cyber specialists on its investigation.
“We are working to ensure customers can get everything they need as quickly as possible,” a spokesperson said. “We would like to thank our customers for their patience and understanding
Meanwhile, in Sweden, attacks on a small number of Co-op and Ica stores saw temperature settings altered
“We can’t adjust the temperatures; we can’t change them. The freezers are blowing out heat. Everything is ruined,” one Ica store manager told the press.
In Belgium, stores operated by Ahold Delhaize and Colruyt under the Spar brand were also impacted, with freezer unit evaporators supposedly set to defrost mode overnight.
According to the BBC, supermarkets in other countries including Estonia, Finland, Luxembourg and the Netherlands have also come under attack.
James Neilson, global senior vice president at Opswat, said: “This is the second time in three weeks, and it won’t be the last. When a remote management layer controls a physical process, it becomes a single point of failure for an entire retail estate, and one compromise can hit many stores at once.
“The scale is smaller than in France, but for each affected store the damage is just as real. Stock has to be destroyed and replaced, suppliers and distribution centres must absorb a surge in demand, refrigeration technicians have to inspect and restore systems site by site, and retailers must reassure customers that what’s back on the shelves is safe.”
OT blind spot
In this instance, and as is often the case in cyber attacks involving critical sectors like energy and food distribution, connected operational technology (OT) and industrial control systems (ICS) that offer threat actors an easy means to cause maximum disruption.
Sweden’s Nationellt Cybersäkerhetscenter (NCSC) – which has been closely monitoring the incidents and working with victims – said the event showed how important it is to protect systems that control and monitor physical processes. Unlike more regularly-updated IT environments, OT environments often include huge amounts of legacy technology that can be much harder, or even impossible, to patch when flaws emerge, leaving them highly vulnerable.
“Retail is an easy target because retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear, much of it installed by facilities contractors who rarely loop in the security team,” said Tom Hegel, distinguished threat researcher and research lead at SentinelOne.
“Grocery margins are thin and stock perishes within hours, so any disruption hurts quickly and in public. The gap between a nuisance and a serious incident often comes down to how much control a victim has exposed to the internet. With thousands of these interfaces still online, I expect more incidents like this.”
Indeed, scans of publicly-visible refrigeration units conducted by Forescout in the wake of the October attacks in France found almost 13,000 vulnerable services across over 6,000 public IP addresses in 99 countries all over the world, with France, Greece and Italy particularly badly exposed.
Among some of the bigger names in the field, it found over 7,000 at risk Copeland/DIxell XWEB services, 4,500 Danfoss StoreView services, 550 Copeland Site Supervisor services, and 500 Carel pCOWeb services.
Concerningly, said Forescout, 80% of scanned Danfoss AK-SM 800A StoreView services – a software platform that provides a user interface (UI) for web access to AK-SM800A refrigeration monitors – were affected by known vulnerabilities. Danfoss equipment was heavily-targeted during the October attacks in France.
Russia link?
Although Moscow has consistently denied any official involvement, hacktivist groups based in Russia and operating in its geopolitical interests have claimed at least 20 attacks against refrigeration systems so far this year, according to Forescout.
Forescout’s researchers said the most active groups behind these attacks were NoName057(16) and the associated Z-Pentest Alliance group.
NoName057(16) has previously linked to a Kremlin-funded non-governmental organisation (NGO) called the Center for the Study and Network Monitoring of the Youth Environment and allegedly operates the Z-Pentest Alliance in collaboration with a group known as the Cyber Army of Russia Reborn.
Although NoName057(16) has tended to specialise in distributed denial of service (DDoS) attacks, Z-Pentest Alliance has been seen focusing on OT environments within critical organisations.
However, SentinelOne’s Hegel said that in this scenario, attribution was harder than it seemed.
“An attacker who logs into an exposed control panel leaves almost nothing behind, with no malware to analyse and few clues beyond an IP address that probably leads to a rented server,” he said. “A teenager and an intelligence service would look much the same from the defender’s side.”
Hegel continued: “These types of attacks typically fall into three main categories: ransomware extortion, political/ideological hacktivism, or nation-state level cyber operations. Ransomware groups usually try to get paid, and hacktivists usually want the public credit.
“In this case, neither has happened which makes it start to look like the low-cost, deniable sabotage Europe has been dealing with for several years, from damaged undersea cables to warehouse arson and GPS jamming.”
Regardless, he added, the advice to retailers in the UK – which does not yet seem to have been targeted – and across Europe, is to take refrigeration system controllers off the internet, put vendor access behind strong authentication, and audit and replace any end-of-life units that no longer get updates.
“Retailers don’t need to know who did it before they act,” he said.
