Analyst Comment
Why European supermarket cyberattacks mark watershed
The cyberattacks on European supermarkets make operational technology a board‑level risk, writes GlobalData’s David Bicknell.
Powered by
Main video credit: Shutterstock AI
An escalating number of cyberattacks on European supermarket refrigeration units should represent a turning point in how organisations will treat operational technology, or OT, in future.
Unlike information technology (IT), which manages electronic data and supports business operation, OT focuses on monitoring and controlling physical assets and devices, and processes. IT systems typically receive frequent updates, either scheduled or automated, to enhance performance and keep software current, as well as patching known vulnerabilities.
But OT systems are often left in a basic state and are not regularly updated. OT systems have a much longer lifespan than IT systems and have been regarded as requiring less frequent updates, with the risk that regular maintenance could disrupt critical industrial processes. In other words, OT assets were left running if they functioned mechanically, under a mindset of “if it isn't broken, don't fix it."
That approach will now change because of the refrigeration cyberattacks. While the hacks affected supermarket retailers such as Carrefour and Intermarché in France, Delhaize in Belgium and ICA in Sweden, as well as catering operators in Italy, they also have implications for refrigeration systems (and indeed a range of critical infrastructure) in other countries. For example, the Centre for Cybersecurity Institute in Singapore is concerned for the country’s cold chain because Singapore imports more than 90% of its food.
Credit: KimVermaat / Shutterstock.com
A primary problem for organisations is that many of their OT systems, including refrigeration systems, are running legacy, end-of-life (EoL), or deprecated firmware that can no longer receive security updates over-the-air.
Many supermarkets and retailers still rely on this legacy technology of systems and devices, which once installed, effectively became invisible. As they performed their function reliably, without fuss, unless something broke, they were just not treated as computers that needed ongoing security maintenance.
Some of them have remained operational for decades, long after their vendors stopped providing security updates. This approach has been described as ‘security through obscurity.’
Another concern is cyber insurance. Cyber insurance policies are not usually designed to handle physical destruction. So, while a cyber policy will typically pay for data restoration, system patch deployment, and forensic incident response, most cyber policies strictly exclude physical asset damage and inventory loss, such as spoiled food in a freezer.
Easy pickings
The hackers targeted refrigeration controllers from a manufacturer that said it had warned supermarket retailers that they needed to update the firmware of the relevant models, because the legacy products no longer receive software or security updates. Crucially, the hackers were able to take advantage of a flaw that the hard-to-update controllers could still be monitored and adjusted remotely by head office or maintenance contractors to save them making site visits.
Such remote access meant a technician could fix a fault at 2am without driving to the store. But as the remote control can be reached from the internet, is often protected by a factory-set password that has not been changed, and runs software that its maker no longer updates, that offered easy pickings for hackers to target. As a result, they were able to override the settings on thousands of freezers, fridges and chiller cabinets, pushing their working temperatures from as low as -27°C to over 50°C, meaning stores had to discard fresh meat, dairy, and frozen products worth hundreds of thousands of euros.
A further cause of cyber insecurity is that many supermarkets have outsourced their cold-aisle monitoring to central cooling maintenance providers, allowing an attacker who breached a single service system to send malicious commands across hundreds of independent storefronts simultaneously.
The attackers were able to suppress internal software alert mechanisms before shifting thermostats into defrost mode, which, because the systems ran unattended overnight, sent fridges’ temperatures soaring, in some cases leading to fires.
The losses incurred by retailers will spur a complete security transformation from the complacent ‘security through obscurity’ mindset.
Frank Smith, Founder and CEO of TowHaul
The losses incurred by retailers will spur a complete security transformation from the complacent ‘security through obscurity’ mindset. OT teams will have to proactively disable default vendor accounts and passwords, ban predictable administrative access bypasses, and mandate the use of multi-factor authentication across all internet-facing control planes. Security teams will move towards the use of strict micro-segmentation and network isolation.
The following lessons should be heeded. One, remove any direct internet exposure. Management interfaces and devices such as the SCADA/refrigeration controllers should not sit on the public internet. Enforce virtual private networks (VPNs) or restricted remote access for third-party maintenance contractors.
Two, catalogue inventory and replace end of life assets: targeted units were legacy systems that no longer received security updates or patches. Operators must catalogue all connected OT hardware, firmware and vendor remote paths and isolate/replace any unpatchable kit.
And, three, implement multi-factor authentication: the use of a basic username and password combination is insufficiently strong for internal staff or external service providers accessing operational equipment.
