Cyberattacks on supermarket refrigeration systems expose IoT vulnerabilities

A series of cyberattacks in Europe has shown how supermarket refrigeration systems can be turned into a weapon against businesses operating them. Hackers remotely manipulated these systems in hundreds of supermarkets and independent stores across France, raising temperatures in freezers and cold rooms to levels that ruined food. Some incidents reportedly triggered fires, forcing retailers to discard food and temporarily take affected equipment offline.

The attacks have spread across Europe, with supermarkets in Belgium, Sweden, Luxembourg, Finland, Ireland, and Estonia reporting similar disruptions. In one incident in Sweden, a supermarket manager reported that the store's freezers had reached 50 degrees Celsius. The attack occurred overnight but was only discovered hours later, compromising the stock. These incidents illustrate a growing cybersecurity problem as businesses connect more physical infrastructure to the internet.

Equipment that was once isolated from outside networks is increasingly controlled through digital systems that allow operators and technicians to monitor performance and make adjustments remotely. For supermarkets, this means refrigeration systems can be managed across several outlets without technicians having to visit each store. However, if digital controllers are poorly protected, this remote access can give hackers the ability to interfere with the equipment.

Researchers say several weaknesses have made these systems vulnerable, including outdated software, manufacturer-default passwords, shared login credentials, and poor control over remote access. A study by US-based cybersecurity firm Forescout identified 12,976 refrigeration management services accessible online across 99 countries and territories, 80 percent of which were running firmware older than the version that addressed known security flaws.

Ethical hacker and researcher Laurens Singier stated that the problem was partly caused by the exposure of industrial devices to the public internet. He emphasized that these devices should not be on the public internet. Refrigeration is part of a wider category of technology known as operational technology (OT), which refers to hardware and software used to monitor and control physical equipment and industrial processes.

A successful attack on these systems can cause physical damage, interrupt essential services, destroy products, and put public safety at risk. Similar weaknesses in hospital refrigeration systems could affect the storage of medicines, vaccines, and blood supplies, while attacks on industrial cooling equipment could disrupt manufacturing and food processing. The European incidents serve as a warning to businesses about the cybersecurity risks associated with connected devices.

To be safe, experts recommend replacing default and shared passwords with individual accounts, introducing multi-factor authentication, and regularly updating software and firmware. Equipment that has reached the end of its support life should be upgraded or isolated from exposed networks. Kenyan businesses should also take note, as retailers, manufacturers, hospitals, and other organizations adopt more connected equipment to manage operations, requiring organizations to treat these devices as part of their cybersecurity responsibilities.

Key points

• The recent cyberattacks on European supermarkets highlight the growing cybersecurity risks associated with connected devices, particularly in the Internet of Things (IoT).
• Refrigeration systems, often connected to the internet for remote monitoring and management, have shown vulnerabilities due to outdated software, weak passwords, and poor control over remote access.
• Experts recommend implementing robust cybersecurity measures, such as individual accounts, multi-factor authentication, and regular software updates, to mitigate the risks associated with connected devices.