Many supermarkets in Europe have had their refrigerators overheated even when they do not have Internet connection features, due to hackers attacking the central control system.

The November 2 attack affected supermarket chains Ahold Delhaize and Colruyt in Belgium and Luxembourg and two Swedish food retailers, ICA and Coop.

In Belgium alone, Euro News noted 40 Delhaize supermarkets were affected, along with at least 15 Carrefour stores, 5 Spar stores and the butcher chain De Laet en Van Haver. Belgian media reported that refrigerator temperatures sometimes rose as high as 70°C.

In mid-October, a similar campaign also targeted supermarkets in France, when hundreds of supermarkets also had their cooling systems tampered with. Carrefour confirmed that 80 of its supermarkets were attacked. Meanwhile, Monoprix, which operates 490 stores in France, said 5% of stores were affected.

According to AFP, unlike regular household refrigerators, which may or may not be connected to the Internet, the refrigeration systems of large supermarkets are operated by a central controller, controlling temperature, defrost cycles and warnings for every refrigerator and freezer in the store. All are connected to the network for remote control.

A study published last month by cybersecurity company Forescout (USA) shows that the ability to connect to the Internet has long been an available option. The feature primarily serves refrigeration contractors, allowing them to control, diagnose problems and adjust settings remotely, instead of having to send technicians to each store.

For example, according to Danfoss, one of the refrigeration suppliers in Europe, connecting the refrigeration control system to the Internet often reduces the number of unnecessary engineer calls for repair by 15-30% because errors can be fixed remotely. In addition, remote monitoring allows supermarkets to automatically keep temperature records as required by food safety regulations, instead of staff having to check each display case by hand up to four times a day.

The manufacturer's installation instructions also show how to put the system on the Internet for external access. For example, users can configure in-store routers to allow Internet traffic to be forwarded to the refrigeration controller.

However, this approach comes with risks. According to Forescout, the risk comes from the fact that management responsibilities are often divided among many parties. The contractor is in charge of the software, the store owns the equipment, and the information technology department manages the Internet connection. When there is no clear assignment, "no party has all the information about the services being used".

Besides, some equipment still has risks due to being outdated. For example, a Danfoss controller that stopped supporting updates in May 2021 was exploited in France last month.

Using Shodan, a search engine that indexes devices connected to the Internet, Forescout found 12,976 exposed refrigeration system management services across 6,017 Internet addresses in 99 countries and territories. Most belong to the two product lines XWEB of Copeland and Dixell (7,075) and StoreView of Danfoss (4,697). As for Danfoss, 80% of devices use old firmware, including systems that are exposed, not just systems that have been attacked.

Also according to Forescout, with popular refrigeration systems, hackers do not need sophisticated malware. Once in, they can use normal functions to change the temperature, trigger the defrost cycle or turn off the alarm in a way that "looks like routine activity", or do it late at night, at dawn - times when a technician or operator is not available to promptly detect abnormalities.

Nathaniel Jones, Vice President of Global Threat Intelligence at cybersecurity company Darktrace (UK), commented that outdated information technology and operational systems when integrated into the control network can become a major security challenge. "A cyber incident not only impacts data or business operations, but can also interfere with physical equipment and cause irreversible damage," Jones told CNet.

According to this expert, the risk is even greater when these systems are distributed in many locations but are all connected to the Internet. At that time, just a device connected to the network can become a target for hackers. "If connected, every other system can become a target," Jones added.

Cyber ​​security experts also say that cyber attacks on supermarkets are a wake-up call about the vulnerabilities of digital systems and devices connected to the Internet. "The more we rely on connection technology, the more we need to pay attention to the important aspects of security and privacy," cybersecurity expert Steven Lachance from Montreal (Canada) told CBC in October after the incident in France.

According to this expert, as the Internet is increasingly integrated into many commercial and residential products, from thermostats, refrigerators, dishwashers to smart light bulbs, the scope of risks also expands. Devices that serve daily needs can become weak points in the network security system.

According to him, the simplest way to deal with the risk of attack is to separate refrigeration management systems from the public Internet and only allow contractors to access through secure tools. In addition, equipment needs to be updated regularly, or replaced if it is too old or outdated.

"Centralized control provides convenience," Lachance said. "Even so, it's a door waiting to be broken."

Bao Lam summary

• Hackers increased refrigerator temperatures to 50 degrees Celsius at a series of European supermarkets
• Hackers increased refrigerator temperatures, causing food spoilage in hundreds of supermarkets