A cyberattack targeting supermarket fridges across Europe that caused millions of Euros in damages should "raise alarm bells" for Britain, experts have warned.
The attack saw hundreds of supermarkets, primarily in France, left without functional units after hackers gained entry to their software and turned up the temperature. Some warmed to temperatures of 50C overnight, according to the chief executive of Coopérative U, one supermarket chain that was affected by the mass breach.
Carrefour, Monoprix and E.Leclerc were also among those hit in the attack, which also hit Spain, Portugal, Poland, Germany and Belgium but to a lesser extent - and experts believe the UK could be next.
How do the hacked fridges work?
Modern supermarkets use a combination of different fridge and freezer systems, including multideck open chillers, glass-doored display cabinets, and the large chest freezers.
These are industrial setups which are not available commercially, and they run on digital systems connected to a single localised network. This means it is possible for bad actors with the right software to gain entry and control the settings these networks govern.
When they do so, the hackers can control the temperature of each fridge unit, activate their defrost cycles, and any remote energy usage.
Who runs them?
In the case of this week's cyberattack, hackers gained access to specific remote control modules made by Danish company Danfoss, US-based Copeland and Dixell.
Danfoss said on Monday that hackers were able to gain entry to the AK-SM800 and AK-SC355 products, which, it added, no longer received software or security updates. The firm added that it was working with affected customers to limit the damage.
The company said in a statement: "We are working with affected customers to implement appropriate mitigation measures, including firmware updates where available, stronger network protections and removing direct internet exposure where applicable."
A spokesperson for Copeland, which owns Dixell, said the firm's top priority is protecting the operations of its customers.
How were they hacked, and who was responsible?
According to French outlet BFM-TV, hackers forced a continuous defrost cycle and set temperatures as high as 50 degrees Celsius (122F) on stores' refrigeration systems.
No one has claimed responsibility for the hack just yet, and CERT-FR, France's national computer emergency response team, said earlier this week that it was unclear how the hackers gained access to the system. The agency also did not outline a specific vulnerability, firmware version, or way in the attackers may have used.
Instead, it issued an alert to supermarkets using the affected systems warning them against exposing management interfaces to the internet.
The spokesperson said it had identified a "vulnerability" in a "discontinued, end-of-life generation of controllers", adding it would be working to mitigate the risks posed by the hack. They said: "We are currently working with impacted customers to mitigate the risk."
Are there any in the UK?
British supermarkets use the same technology to cool and freeze products, but they don't use Danfoss units quite as widely as their French counterparts.
The UK has a host of its own firms that manufacture fridge and freezer units, including Arneg UK, AHT Cooling Systems UK and Hussmann UK, which are used across a wide variety of different supermarkets. They are still present, however, according to cyber defence agency UK Cyber Defence.
The firm told The Grocer it found 15 Danfoss fridges across the country that were accessible on the open internet. The firm said it was "accurate to say it is highly unlikely that they have been patched".
Could hackers target British fridge systems?
Speaking to The Mirror, Simon Michie, Managing Director at Risk Crew, said the principles deployed in hacking could also transfer to other vendors in future cyber attacks.
He said: "While the situation is developing and we don't know the root cause yet, the security weaknesses are familiar from other technology environments. Attackers appear to have exploited outdated equipment that had reached its end of life, with no recent security updates available.
"In this case, it's likely the equipment was reachable by the hackers because the store's operational technology network is joined to the business network.
"The risk could have been reduced by disconnecting the outdated equipment from the network, preventing attackers from accessing it remotely, which has clearly not happened. There is also a chance this was a supply chain attack via the Danfoss software monitoring service.
"Of course, the principles transfer to other OT (operational technology) vendors. The lesson is to pay more attention to OT networks and connected devices, which are often off the radar, such as copiers, webcams and other appliance."
Should British supermarkets be preparing?
Marijus Briedis, Chief Technology Officer at NordVPN, said the attacks "should ring alarm bells" in Britain, especially if retailers are using internet-connected systems.
He said: "The cyberattack on supermarket fridges in France should ring alarm bells in Britain. If UK retailers use internet-connected refrigeration systems with similar security weaknesses, hackers could cause the same disruption here.
"There is no evidence British supermarkets have been affected by this incident, but distance offers little protection when criminals can reach vulnerable equipment remotely.
"Hackers don't need to get into the tills to cause havoc in a supermarket. Interfere with the equipment keeping food cold and you can force stores to throw away valuable stock, shut entire aisles and leave shoppers facing empty fridges and freezers.
"A cyberattack can quickly become a food safety problem, as well as a very expensive one for retailers. British supermarkets should be checking their connected refrigeration systems now, especially older equipment that may no longer receive security updates.
"Remote access needs to be tightly controlled, critical systems separated from the wider network and independent temperature alerts and manual checks in place. One vulnerable controller should not be allowed to put an entire store's chilled food at risk."
