European Supermarket Shutdown

Nov 3

Sacré Bleu - Supermarket Sabotage

Governments around the globe are finally sounding the alarm on critical infrastructure attacks, urging citizens to stock up on vital supplies to prepare for emerging energy grid and water supply threats. And while many organizations have been enacting strategies to defend against lengthy power outages and water contamination schemes, food security measures have fallen to the wayside. Most food cybersecurity measures revolve around IOT-driven supply chains, which are an undeniably vital part of the infrastructure, and a glaring digital vulnerability, but far from the only threat facing modern food systems.

Earlier this month several European supermarket chains were hit by a series of cyber attacks targeting their refrigeration controls. Tons of food products were spoiled as supermarket freezers reached temperatures of over 122° Fahrenheit, with multiple units catching fire due to the extreme heat. Over 300 stores were affected in France alone, with E. Leclerc, Intermarché, Cooperative U, Carrefour and Monoprix shouldering the brunt of the attack. While final numbers have yet to be disclosed, it’s estimated that the impacted storefronts have lost tens of millions of euros worth of inventory.

The origin of attack has been linked to a compromise in the remote refrigeration controls provided by Danish company Danfoss, more specifically their Copeland xweb, Danfoss AK-SC series, Danfoss AK-SM series, and Dixell xweb systems. Danfoss claims the regulatory systems hit were all “legacy models” that they had urged supermarkets to upgrade from, on account of them no longer receiving necessary software and security updates.

And while stores should have taken Danfoss’s security advice seriously, the main issue lies in the fact that supermarkets were never designed with cybersecurity in mind, and do not often have the immediate resources or bandwidth to roll out new systems as soon as legacy ones expire. Several of the French supermarkets affected were small, rural locations, who never expected to be targeted in a major cyber attack, as is true for the majority of stores who will remain vulnerable to these kinds of remote attacks.

Even more importantly, this cyber attack was largely unprecedented. It’s the first of its kind to target a nation’s food supply to this scale and in this way. And the impact was not only felt in France – several storefronts across Belgium, Germany, Spain, Portugal, Poland, and the Netherlands were also affected by a supermarket targeted campaign, as well as America to a lesser degree. Stores owned by Ahold Delhaize faced severe disruptions to internet facing services and operations, such as websites and distribution centers, as they were likely operating under similarly unsecured systems.

Securing Global Supermarkets

The identity of the hackers and the exact flaws they used to execute these attacks are still unknown, but have caused much unrest in France in particular, as they believe this to be sabotage from Russian state actors as a result of the support France provided to Ukraine during their invasion. In any case, people are becoming far more aware of the lapses in security vital organizations have been indulging in. With the speed at which exploits can be discovered and executed at scale, critical infrastructures can no longer afford to push back security updates, not if they want to continue to reap the benefits of internet-connected services.

In other words, critical agencies and organizations have drastically and rapidly (a deadly combination) increased their attack surfaces with the introduction of multiple IOT systems into their standard operations, and their outdated security frameworks have no chance of catching up.

Edit - November 2nd – New Wave of Supermarket Cyber Attacks

The start of November has thrown this security lapse into even sharper relief. Another wave of cyber attacks swept supermarkets across Europe, shutting down stores in Belgium, Luxembourg, Sweden, Finland, Ireland, Estonia, and the Netherlands. Delhaize, ICA, Coop and Kesko were the chains most affected this time, and cybersecurity teams believe they fell victim to the same vulnerabilities exploited in October.

While the exact vulnerabilities and attack pathways still have yet to be verified, expert recommendations remain the same. Stores with online refrigeration controls are advised to only operate on secure networks, and to replace units with outdated hardware that prevents routine security updates.