Attacks on refrigeration systems: European supermarkets hit, physical and financial damages

New cyberattacks hit refrigeration systems in European supermarkets

After the mid-October attack that compromised the refrigeration systems of several French supermarkets, causing food spoilage and some fires, a wave of similar attacks hit distribution chains in Belgium, Ireland, Sweden, Finland, and Estonia. The incidents, which occurred last Monday, caused sudden temperature changes in refrigerators and cold storage rooms, as confirmed by a Bloomberg report. Among the affected retailers are giants like Carrefour, Spar, and Ahold Delhaize. No group has so far claimed responsibility for the attacks.

Quick Response

The challenges of incident response

Analysts and consultants have stated that the lack of an immediate response to the initial attacks is understandable, given the complexity of refrigeration systems and the presence of multiple vendors involved in their management. Katell Thielemann, Distinguished VP Analyst at Gartner, emphasized that while retailers own the hardware, maintenance and management are often outsourced, creating confusion over system ownership and responsibility.

Asset visibility issues

Bobby Kuzma, Senior Research Manager at IDC, highlighted a significant visibility gap between threat intelligence teams and those managing industrial operational technology (OT) systems. This gap can lead to a lack of awareness among cybersecurity teams about the existence of Internet-connected devices, especially if these use dedicated circuits for vendor support. The lack of an accurate asset inventory makes it difficult to identify and protect vulnerable systems.

Managing IoT outside of IT

David Neuman, executive advisor at Acceligence, observed that recommendations from cybersecurity authorities often do not significantly solve security problems. Refrigeration systems are often installed and managed by external contractors who require constant data access for monitoring and maintenance. This can lead to situations where refrigeration control devices are not included in the organization's security inventory.

Legal and contractual implications

Frank Dickson, principal analyst at Dickson Research, emphasized that legal and contractual implications can hinder rapid response to attacks. Before disconnecting refrigeration controllers from the Internet, companies must verify insurance terms in contracts with refrigeration providers. This process can take time, leaving systems vulnerable to attacks. Dickson also warned that attacks on refrigeration systems can pose an indirect threat to traditional IT systems, as servers and other equipment are sensitive to temperature changes.

The importance of physical security

Brian Levine, partner at Control Risks, stated that these incidents put an end to the debate about managing the security of connected operational devices as a matter of easy maintenance. The attacks demonstrate that physical security is a critical priority that requires adequate planning and budget. Companies must review contracts with vendors, develop incident response plans, and conduct simulation exercises to address the physical consequences of cyberattacks.

The need for independent security controls

Noah Kenney, principal consultant at Digital 520, highlighted that the main concern is not just access to refrigeration systems, but the ability of attacks to manipulate systems outside their operational parameters. Kenney emphasized the importance of having independent security controls that prevent harmful commands, even in the event of unauthorized access. Additionally, he noted that some devices involved in the attacks had exceeded their useful life, making security patches and updates unavailable.

The challenge of unmanaged IoT

Carmi Levy, independent technology analyst, observed that many organizations do not consider IoT devices, such as refrigerators, on par with servers and smartphones. This can lead to a lack of firmware updates and inadequate security management. Levy emphasized the need for a broader view of what constitutes a connected device and proactive management of IoT security.

Impact on compliance and cyber insurance

Attacks on refrigeration systems raise important compliance issues, particularly in light of the NIS2 directive and the DORA regulation. Companies must ensure digital operational resilience and protection of sensitive data, even in OT environments. Furthermore, the attacks highlight the need for adequate cyber risk insurance that covers physical damage caused by cyberattacks.

The need for a managed SOC

The incidents highlight the importance of a managed Security Operations Center (SOC) to monitor and respond to attacks in real-time. A SOC can provide the necessary visibility to identify and quickly respond to threats, even in complex and distributed environments like refrigeration systems.

Risk management and continuity

To address these challenges, companies must adopt a proactive approach to risk management, which includes continuous assessment of refrigeration systems and implementation of appropriate security controls. Additionally, it is essential to develop business continuity plans that account for potential physical impacts of cyberattacks.

The need for a zero trust architecture

Attacks on refrigeration systems underscore the importance of adopting a zero trust approach to IoT device security. This approach requires rigorous authentication and authorization of all devices and users, regardless of their location in the network. Implementing a zero trust architecture can help prevent unauthorized access and limit the impact of attacks.

Protection of sensitive data

Attacks on refrigeration systems can also expose companies to risks of Data Loss Prevention (DLP). Sensitive information, such as customer data and financial information, can be compromised if refrigeration systems are connected to corporate networks. It is crucial to implement DLP solutions to protect sensitive data and prevent information leaks.