How do you hack a supermarket fridge, and why would anyone want to?

SUPERMARKET FRIDGES AND freezers have become the targets of cyberattacks across Europe, with chilled and frozen food removed from sale at 13 SuperValu stores in Ireland today.

Musgrave confirmed that a cyber incident had affected its refrigeration systems (and has since been resolved), while retailers in six other European countries also reported problems.

The incidents follow attacks in France last month that sent temperatures in supermarket refrigeration systems as high as 50C, spoiling food and causing fires.

Unlike attacks that steal customer information or knock websites offline, these incidents interfere with equipment that keeps food safe to sell.

But how do you hack a fridge, why would anyone want to, and could connected appliances at home be vulnerable too?

How can someone hack a supermarket fridge?

The connection that allows an engineer to monitor a fridge from elsewhere can create an opportunity for an attacker.

Brian Honan, CEO of BH Consulting and a cybersecurity expert, told The Journal that supermarket refrigeration systems are often connected to the internet so that suppliers can check their performance and identify faults.

“If a fridge develops a fault, they can proactively send an engineer out to the supermarket to minimise the downtime for that particular fridge,” Honan said.

If attackers gain access to those controls, they may be able to change how the equipment operates.

In France, Honan said, attackers did not switch the freezers off; instead they increased temperature settings, causing them to defrost and creating a potential fire risk.

France’s cybersecurity agency CERT-FR has warned of compromises involving remote refrigeration controllers from several manufacturers.

It advised operators to remove direct internet exposure and secure remote access.

Honan said the SuperValu incident sounded similar, but Musgrave hasn’t confirmed the precise method used to compromise its systems.

What do we know about SuperValu?

Musgrave said its monitoring systems detected the problem and it took immediate action.

“As a precaution, chilled and frozen products in the affected stores have been removed from sale, and all other products remain available as normal,” a spokesperson said.

“Customer safety is our first priority, and customers can be confident that products on sale in our stores have been stored at safe temperatures.”

The company said it was working with equipment suppliers and cybersecurity specialists to restore normal operations.

Its statement did not name the 13 stores, identify the refrigeration model or put a value on the stock affected, though it’s now known that shops in west Dublin (Blanchardstown, Lucan) and Waterford (Kilbarry) are among those impacted.

Musgrave’s statement also did not establish a connection with the overseas incidents.

Where else has this happened?

During the previously mentioned incident in France, hundreds of supermarkets were affected.

Today, seven countries (including Ireland) were impacted.

In Belgium and Luxembourg, retail outlets Ahold Delhaize and Colruyt reported cyberattacks targeting their fridges.

Swedish chains ICA and Coop reported refrigeration problems, with one store saying its equipment had been set to 50C.

Advertisement

In Estonia, refrigeration supplier Kitman Coldtech told public broadcaster ERR that attackers had accessed a computer controlling a supermarket’s refrigeration and turned up the temperature.

Finland’s National Cyber Security Centre also confirmed several suspected attacks. Specialist Juha Tretjakov told Ilta-Sanomat that authorities had received reports of successful intrusions and limited damage.

Dutch broadcaster NOS reported that at least 17 businesses in the Netherlands, including butchers and neighbourhood shops, had suffered similar attacks, citing Danish equipment manufacturer Danfoss.

Why target fridges?

The motive hasn’t been established yet. Honan cautioned against assuming the purpose was to demand money.

“This could simply be somebody out to create mischief and havoc, just to prove they could do it,” Honan explained.

He added that some attackers seek recognition among other hackers by demonstrating what they can compromise.

Extortion is another possible motivation for attacks on connected equipment, but Honan stressed that this was a general possibility, rather than an established explanation for today’s incidents.

“There’s no evidence of that in these attacks today,” Honan said.

The financial consequences could still be big for SuperValu and other European supermarkets today, as the incident will likely lead to spoiled stock, repairs and bringing in specialists to investigate.

Who is behind it?

There is no confirmed public identification of those responsible for any of the continent-wide incidents described here.

Authorities have not identified the perpetrators of last month’s French attacks, and no group has publicly claimed responsibility.

Honan said tracing an attacker can be difficult because they can disguise where their activity originates, including by using other compromised computers.

“The international nature of the internet means the attack could be coming from anywhere in the world,” Honan said.

Investigators may have to gather evidence across several countries, and arrests can come years after an attack.

“They can be quite difficult to find. Yes, not impossible, but it can be quite difficult,” he said.

Could someone hack my fridge at home?

If it is internet-connected, it is potentially a target. That does not mean an ordinary fridge without an internet connection can suddenly be controlled remotely.

Honan said the concern extends to other connected household devices, including smart televisions.

“Basically anything that’s connected to the internet is potentially a target, and I’m not trying to be alarmist here,” he said.

Whether it can be compromised depends on the device and how it is protected. The supermarket incidents do not establish that household fridges are being targeted.

What can be done to stop cyberattacks?

Honan advised changing the default login details supplied with devices, keeping software updated and ensuring the home or business network is appropriately protected.

Updates matter because they can close security weaknesses that attackers might otherwise exploit.

For businesses, he said the lesson extends beyond refrigeration.

“If there are any devices they have connected to the internet, they need to ensure their security measures are appropriate to protect them from attack,” Honan said.