What we know so far: Last month’s cyberattack on French grocery store refrigerators became a costly reminder of the risks posed by critical infrastructure’s reliance on the Internet of Things. New attacks this week show that several European countries are facing the same vulnerabilities, with lax security practices and outdated systems the likely culprits.
A cyberattack on internet-connected refrigeration systems ruined food in grocery stores in at least seven European countries on Monday. A Belgian Delhaize branch estimates losses at 100,000 euros. The attack is similar to one that hit French grocers in mid-October and exposed gaping security flaws.
Grocery stores and chains in Ireland, Luxembourg, the Netherlands, Belgium, Sweden, Finland and Estonia reported that refrigerators were set to defrost, causing temperatures to rise to 50 degrees Celsius (122 degrees Fahrenheit) in some cases, causing food to spoil and leaving many shelves empty. The French attack brought cooling systems to the same temperature and caused damage estimated at tens of millions of dollars.
An ICA executive in Stockholm told Reuters on Monday that staff did not notice the attack, which occurred at 2 a.m. local time, until hours later and by that time “everything” was destroyed. Other target companies include Delhaize in Belgium and Luxembourg, Carrefour and De Laet & Van Haver in Belgium, Coop in Sweden and more.
It remains unclear who was responsible for the attacks. No one has claimed responsibility, and at least some affected stores have security flaws so large that virtually anyone could have accessed their systems.
The refrigerators attacked in France were operated by Danfoss, and the incident came two months after security researchers at Claroty warned of several vulnerabilities in the company’s controls. In at least some of Monday’s attacks, Danfoss also supplied the affected units, although Belgian installer Sabcobel, which operates Delhaize’s refrigeration systems, was also involved.
Security researcher Kevin Beaumont says that several thousand Danfoss management systems are accessible directly over the Internet, with virtually no login security. According to him, the username is “admin” and the password changes daily to the current date. Claroty’s research points to a hidden day code derived from the date that bypasses the real password, a bug that Danfoss has since fixed.
Additionally, many affected systems were running outdated firmware and some cannot receive patches at all because they are out of date, a common risk with IoT devices. Shodan.io shows thousands of exposed Danfoss units, more than half in France, more in South Africa and elsewhere.
Whether a sophisticated state actor or a bored individual is behind the attacks, they represent another lesson in IoT pitfalls. Some also fear that similar incidents could be part of a broader effort to destabilize a country’s infrastructure.
