A cyberattack breaking the cold-chain in supermarkets: an alarm signal sent to connected industrial systems

The latest cybersecurity highlights

• A cyber attack breaks the cold chain at many supermarkets: 300 to 400 French supermarkets were reportedly affected, after remote modification of refrigeration controllers, with economic and health risks related to the rupture of the cold chain;
• Potential vulnerabilities and attack scenarios: though the attack is still  under investigation, our experts think it could have exploited old or poorly secured refrigeration supervisors: exposed interfaces, insufficiently protected remote maintenance and weak passwords…;
• A threat that goes beyond retail: this incident is a reminder that the compromise of connected industrial systems (IT/OT) is constantly increasing and can disrupt essential activities. Securing them through updates, access control and reduction of web exposure and leaks - is becoming urgent.

Industrial systems as increased targets

During the night of 11 to 12 October, several hundred French supermarkets were victims of a cyber-attack targeting their refrigeration equipment. By remotely modifying the parameters of refrigeration supervisors, the attackers would have caused the breaking of the cold chain in many stores, with a significant economic and above all health impact. This incident perfectly illustrates the rising ability and will of cybercriminals and hacktivists to attack connected industrial systems - also called IT/OT systems – as today’s prime targets.

Breaking the cold chain on a large scale

The consequences of this cyberattack are very real since 300 to 400 stores, notably belonging to the brands Intermarché, Netto, “U” and E Leclerc would have been affected. When we know the consequences of health risks related to the cold chain interruption, this new episode is not to be taken lightly. It marks an underlying trend among cyberattackers: targeting industrial systems or IT/OT (standing for Informational Technologies/Operational Technologies) systems with a very real impact on citizens' daily lives. 

A dead cold procedure

The attackers reportedly modified the settings of refrigeration supervisors remotely from Danfoss, Copeland, and Dixell brands ^(1). Doing so, they have notably succeeded in forcing the activation of de-icing and the partial neutralization of food temperature-related alarms.
The vulnerabilities that allowed attackers to break the cold chain were linked to older generation cold-monitoring devices, which no longer received security updates.

Unlike a ransomware attack, no ransom was requested and no data exfiltration has been reported at this stage. It is a show of force whose impact is mainly operational, financial and health.

Several leads regarding the initial compromise

The Paris public prosecutor’s office has already opened an investigation. If at this stage no official cause for the origin of the compromise is established, several credible hypotheses can be raised:

- Administrative interfaces exposed on the internet;

- Insufficiently secure remote maintenance access;

- Weak passwords and/ or unupdated equipment. 

«This campaign is probably still ongoing: other industrial sectors, other countries and other technologies could be impacted, as long as assets are still exposed. ONYPHE⁽²⁾ lists 6,212 IP addresses in 95 countries that expose the Danfoss interface on the Internet, nearly half of them in France. For its part, Modat ⁽³⁾ has about 5,000 Danfoss SM800A supervisors and nearly 4,000 Copeland equipment on display, mainly in the United States and Italy, says Pierre-Yves Amiot, Operations Director of CERT."

A threat that goes beyond large-scale distribution

This attack marks a turning point: a few changes in parameters were enough to cause large-scale economic and health consequences.

«This campaign demonstrates that cybersecurity is no longer just about information systems. Industrial equipment, technical infrastructure and connected objects that drive the physical world are now targets in their own right, says Christophe Dernys, Head of Trusted Solutions at Orange Cyberdefense.  

The procedure that involves exploiting one or more flaws in the supply chain of one or more brands can also be applied to other essential or even critical resources and industrial sites: logistics warehouses, the agri-food industry, pharmaceutical sites, production plants, critical technical infrastructure, energy, hydraulic or nuclear. 
“For CISOs, industrial managers and business divisions, the question is no longer whether these systems need to be secured, but rather how quickly this securing can be implemented” concludes Christophe Dernys. 

Sources and notes