Supermarket cyberattack in Europe: how hackers hit fridges

The hackers who attacked supermarket cooling systems in at least eight European countries on Monday most likely used elementary passwords such as “12345”. Laurens Singier, an expert at Belgium’s Howest University, showed Reuters how it could have looked.

At the Cyber 3 Lab, he works with a system that mimics the equipment controlling refrigeration in stores. He types the login “admin” and the password “12345” into the sign-in window, and within seconds he has the cooling control panel. “I press one button and the heating comes on. I press another and it switches off,” he demonstrates.

A hundred fridges, one computer

According to Singier, a large store can have up to a hundred refrigerated and freezer units. They are not configured individually: a single control computer, a so-called programmable controller, is in charge of everything. It decides when to cool and when to heat, for example during regular defrosting. Maintenance staff connect to it through a web interface. “It’s an ordinary website, like facebook.com,” the expert explains.

In his view, the root of the problem is that the interface was exposed directly to the internet, so anyone could get in. On top of that, owners often failed to change the factory logins and passwords. The third weakness was outdated versions of the systems with a known vulnerability, which made it possible to crack a password even if it had been changed at some point.

Singier believes the attackers tried precisely the login “admin” and passwords like “12345”. Anyone who got inside could switch the equipment to defrost mode with a single click. “And a pile of food ended up in the trash,” the expert says.

A second wave in three weeks

Monday’s attack affected dozens of stores in at least eight countries. They include Carrefour and Delhaize stores in Belgium and ICA and Coop in Sweden. Three blood banks in France were also affected.

This is already the second such attack in Western Europe in three weeks. In mid-October, refrigerated units in hundreds of French supermarkets heated up to 50 degrees Celsius, and fires broke out in several stores. According to media reports, the French cybersecurity agency then found a vulnerability in software from the Danish company Danfoss.

Singier’s account largely matches what the authorities and the manufacturer have already officially confirmed. After the October attack, the government agency CERT-FR warned above all that refrigeration controls were accessible directly from the internet. According to the agency, older devices that no longer receive security updates are especially vulnerable. Danfoss said the affected systems were running outdated software. CERT-FR does not list factory passwords among the causes, but recommends that operators change them.

Danfoss systems were attacked again this week. On the manufacturer’s advice, stores disconnected them from the network on Tuesday, and the company is working on fixes with its customers, according to Reuters.

Singier thinks the hackers most likely did not pick specific chains. Control computers exposed to the internet are as easy to find as ordinary websites: you can tell which country a device is in, but not who owns it. “Most likely, they were targeting a particular country or region,” the expert says.

Attacks on industrial equipment are still rare, but Singier expects them to grow: artificial intelligence makes such attacks easier even for amateurs. “The code for an attack like this can already be generated with one simple prompt,” he says.

Around Prague, based on reporting by seznamzpravy.cz