The intitial investigation is in.
In a “bizarre and unprecedented” cyber-attack, hackers had remotely overridden the temperature settings on thousands of freezers, fridges and chiller cabinets pushing them from as low as -27C (-16.6F) to well over 50C (122F).
If shop managers first assumed it was an isolated failure, it soon became clear up to 700 stores – including those from the Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix chains along with a number of smaller independent shops – had been victims of a cyber-attack.
The hackers had pirated the controllers supplied by the Danish company Danfoss that controls the freezers and fridges. Most supermarket cold aisles are connected to the internet to allow remote maintenance and alerts for system failures. Initial investigations suggest the hackers disabled alarm systems before tampering with the thermostats, or extended the defrost programme by several hours to avoid triggering alarms.
Danfoss said it had identified security flaws last year and had “long recommended” that customers install updates or replace obsolete unsupported systems. The affected refrigeration units were “running outdated firmware”, it said. In the days following the first wave of attacks, France’s cyber-attack alert centre ANSSI confirmed supermarkets using controllers from two other companies were also targeted.
That’s fine when you have one fridge.
Then you need to look after four thousand of them.
Oh, it’ll be fine, we’ll just set things once while installing them.
Oh look! New food, or efficiency, or store standards have dropped, now you need to update those settings in those 4 thousand fridges spread across the whole country. Well, we can do a couple of stores a day, I guess it’ll only take a month of a service tech’s time and travel costs to do it.
Orrrrrrr… we could hook these fridges up to the Internet and do it remotely, and update the settings on those 4000 fridges before lunch.
That’s the draw, convenient mass update. The main issue here is that they put the fridges on an unsecured network, and then on device auth was laughable, allowing any bored teenager with time on their hands to tinker with things.
Orrrrrrr… we could do it the ole fashion way and not add a layer(s) of failure and send out a email… Don’t need security w/ a thermometer and a knob.
I like my version better, simple.
And be real, there is no ZOMG moment in food safety that requires a mass temp change ASAP. Freezers are below freezing and refers have been set to the same temp for 50+ years.