Unplug your smart fridges, French supermarkets warned after cyberattack

More internet-connected refrigerators have joined the official list of those affected by a cyberattack that ruined stocks of chilled food at hundreds of French supermarkets over the weekend.

The French Computer Emergency Response Team (CERT-FR) advised supermarkets to disconnect any refrigeration control systems with a public IP address from the internet, and to reconnect them via a secure VPN only after verifying the configuration and, if necessary, restoring factory defaults.

In an emergency, it suggested, they could simply filter connections to allow only the IP addresses of their refrigeration suppliers or service providers to connect, but this should not be a long-term solution, CERT-FR said.

CERT-FR’s initial warning on Monday listed only Danfoss AK-SC and AK-SM series refrigeration controllers as affected, advising supermarkets to update the firmware of their systems, set the security level to “strict,” and ensure that default passwords had been changed.

One of the supermarket chains hardest hit in the attack was Groupement Mousquetaires, which operates under the Intermarché and Netto brands. It promptly removed products from affected fresh and frozen food display units managed by Danfoss in some of its stores, a spokesman said.

Following the attack, French control systems vendor Dixell posted presciently on LinkedIn: “Cybersecurity is everyone’s business, all the time. Today, our competitors were targeted; tomorrow, it could be our turn.”

And so it came to be.

As the list of victims grew, it became apparent that not all the affected supermarkets were using refrigeration controllers supplied by Danfoss, prompting CERT-FR to add other models to the list sold under the Dixell and Copeland brands.

Dixell published a security advisory for user of its XWEB internet interface, broadly along the same lines as CERT-FR’s advice. It recommended immediately upgrading systems running version 1.12.1 or older; changing weak or default passwords and activating password security policies on compatible systems; and securing remote access through a VPN, a dedicated 4G mobile data connection, or in an emergency by applying an IP address filter.

Tom Hegel, research lead at cybersecurity monitoring company SentinelOne, said the attacks are unlikely to stop with Danfoss and Dixell/Copeland: “With thousands of these interfaces still onine, I expect more incidents like this.”

Those interfaces are online because supermarkets often buy “refrigeration as a service,” with providers guaranteeing performance as long as they have access to a constant stream of data from the refrigerators they maintain. The data also enables them to guarantee traceability of the cold chain.

As with much legacy operational technology (OT), the security of such systems has largely escaped the notice of CISOs until now.

“Retail chains run enormous estates of refrigeration controllers, building management systems, door access panels, and point-of-sale gear, much of it installed by facilities contractors who rarely loop in the security team,” said Hegel.

As they scan and secure their systems, supermarket CISOs will be wondering who attacked them, and why — but with the off switch for their refrigerators effectively posted to the public internet, those will be hard questions to answer.

“An attacker who logs into an exposed control panel leaves almost nothing behind, with no malware to analyze and few clues beyond an IP address that probably leads to a rented server. A teenager and an intelligence service would look much the same from the defender’s side,” said Hegel. “The gap between a nuisance and a serious incident often comes down to how much control a victim has exposed to the internet.