Hackers are targeting something the world cannot do without: Food

A wave of mysterious cyberattacks on supermarket refrigerators and freezers across Europe has raised concerns about a new form of disruption, with hackers turning their attention to something people cannot do without -- food.

Refrigeration systems in supermarkets across seven European countries were targeted in the latest attacks, with thermostats remotely turned up to as high as 50 degrees Celsius in some cases.

The incidents affected retailers in Belgium, Sweden, Luxembourg, Finland, Ireland and Estonia, while similar attacks had hit French supermarkets weeks earlier, forcing stores to discard large quantities of food.


Also Read: Why are supermarket fridges connected to the internet, and how are hackers exploiting them?

The attacks have exposed how a seemingly ordinary part of the food supply chain can become a target when connected to the internet.

Unlike conventional cyberattacks that seek to steal information or extract money through ransomware, taking control of refrigeration systems can cause immediate physical damage, which is food getting spoiled, disruption of store operations and potentially affecting consumer confidence.

The European Union condemned the incidents as a “deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”.

However, no group had claimed responsibility, and investigators had not established who was behind the attacks or what their precise motive was.

Why target food?

Food offers hackers a particularly visible way to disrupt everyday life. Supermarkets depend on refrigeration to preserve perishable goods, and raising temperatures in their freezers can render products unsafe or unsellable before retailers have time to respond.

The damage is also difficult to reverse, which means that by the time a retailer discovers that its refrigeration systems have been compromised, the food may already have spoiled.

Unlike a ransomware attack, in which a company might be able to restore access by paying a ransom or recovering its systems, the physical loss of food cannot simply be undone.

The attacks also appear to exploit a vulnerability that is relatively easy to overlook. Commercial refrigeration systems are increasingly connected to the internet, allowing retailers and service providers to monitor and control temperatures remotely. But unlike computers and mobile phones, the software running these systems may go for long periods without security updates.

Nick Jackson, director of cyber-operations at Romania-based cybersecurity company Bitdefender, said in a Guardian report that installing software patches could be difficult because the process might require machinery to be taken offline, which is an obvious problem for food retailers.

Also Read: IKEA store in Belgium hit by fridge cyberattack; refrigeration systems impacted as supermarkets across Europe face issues

In some cases, the people operating the refrigeration systems might simply be unaware of the security risks, he said.

According to AFP, Swedish retailer Coop said some of its refrigerators were connected to a 4G mobile network, which made them more exposed to attacks.

ICA, meanwhile, said its refrigeration system was supplied by Danish company Danfoss, whose equipment was also affected in the earlier attacks in France.

The Guardian reported that older refrigeration systems can remain vulnerable because their software may go for long periods without security updates.

But the question of why hackers chose food as a target remains unanswered.

No politically motivated hacking group had claimed responsibility, and no ransomware gang had demanded payment, as per the Guardian report.

Rafe Pilling, senior director for threat intelligence at cybersecurity company Sophos, told the Guardian that the two most plausible explanations were a state-backed demonstration of capability or an individual hacker acting independently.

The report added that a state-linked operation was considered a possibility because of the psychological impact of seeing food removed from supermarket shelves. Hackers linked to Russia and China could come under scrutiny, but there was no confirmed attribution, it said.

The relative simplicity of the attacks could also make identifying those responsible difficult. Pilling compared the method to “wearing rubber gloves and messing with the switches”, noting that the attackers did not need to deploy malware that could leave a trace.

What else is at stake?

The attacks have raised concerns that the same vulnerabilities could extend beyond supermarket refrigerators.

An expanding range of devices that were once largely mechanical can now be monitored and controlled remotely, including heating systems, security cameras, alarm networks and household appliances.

A compromised device can be used to change settings, switch equipment on or off, gather information or gain access to other systems on the same network. The implications could be wider when connected equipment is used in businesses and essential services, a Reuters report, citing a 2015 researchers' demonstration at a Las Vegas hacking conference said.

A series of mysterious freezer malfunctions affected military-base commissaries in the United States in August, with the Pentagon investigating a suspected cyberattack, Reuters reported.

For retailers, the immediate response lies in securing and updating the software that controls refrigeration systems.

Belgian refrigerator group Sabcobel told the Guardian that the impact of the latest attacks could have been worse had it not begun patching equipment after the October 12 incident in France.

The incidents have therefore raised a broader question about the security of infrastructure that keeps everyday life running. As more physical systems become connected, the consequences of a cyberattack may no longer be confined to stolen data or disrupted computer networks, but it could reach the food people buy and the systems that keep it safe.