From Cars to TVs: Supermarket Refrigerator Hacks Highlight Growing Risks of Connected Devices

A new round of supermarket refrigerator hacks hit dozens of stores in several European countries, and the Pentagon is investigating whether refrigerator issues in stores on American military bases might be connected.Grocery stores in Belgium, Estonia, Finland, Ireland, Luxembourg, and Sweden were hit in a cyber attack that sent temperatures in refrigerators and freezers soaring to as high as 122 degrees Fahrenheit during the overnight hours while stores were closed.Swedish chain ICA confirmed freezer units in some of its stores were hacked. A location at Sjöbo in southern Sweden said in a Facebook post that it had to delay opening to give workers time to dispose of all frozen and refrigerated products. The store received a lot of questions about why it couldn’t simply sell the food at a discount. “We simply do not know how our refrigerators and freezers have behaved overnight and early in the morning,” the post explained. “Therefore, we cannot guarantee that the goods will maintain the quality we want and we take no risks if you as a customer become sick from the goods!” it continued.“We are extremely sorry to have to throw out all this food, but we see no other way,” the post added.Belgian supermarket chain Delhaize said about 40 of its stores also experienced a “computer incident” that hit cooling units.The losses between all of the stores could be in the millions of Euros, according to European media.The Danish company Danfoss confirmed its refrigeration control systems were targeted in the hack, as well as a similar incident in October in France that involved the hacking of refrigeration units in around 700 stores. Danfoss controllers are widely deployed across stores, cold-storage facilities, and warehouses. The devices that were compromised were believed to be using an older software version that is no longer supported or given updates.The attacks did not come before a warning about vulnerabilities with the cooling systems. Security firm Claroty, in August, published a report outlining multiple vulnerabilities affecting the Danfoss web management interface that allows remote access to them. Danfoss addressed the issues by releasing a new firmware version, but the update could not be deployed on some older machines that were still in service.Criminal investigators from the Pentagon are leading a probe of freezer failures in August at American military bases, and whether there is a link to the European hacks. The freezer malfunctions took place at military commissaries. The commissaries are on-base food stores for active-duty personnel and their families than can be less expensive than commercial grocery stores.Fort Huachuca officials said the outage not only affected frozen food but produce and reach-in coolers. The machines were unplugged after they went into defrost mode, spoiling all of the food.“I can confirm that the Department of the Army Criminal Investigation Division’s Cyber Field Office is actively working with the Defense Commissary Agency and the Defense Criminal Investigative Service (DCIS) to determine the full extent of what occurred with the refrigeration units in the commissaries on military installations,” an Army public affairs officer, Thomas Hamilton III, said in an emailed message to the Sun. “Army CID’s Cyber Field Office is also working with DCIS and French law enforcement in understanding the refrigeration outages in Europe,” he added.The Defense Criminal Investigative Service declined to comment to the Sun on the ongoing investigation “consistent with our policy and to preserve the integrity of the process.”Investigators have not linked the European hacks to the failures at American military bases or even confirmed the equipment had been hacked.Organizations connect refrigeration systems to the internet so they can be remotely monitored. Remote systems engineers can adjust operating schedules, review alarms, and configure temperatures without having to physically visit every location. Cybersecurity expert Brian Honan told Irish news outlet The Journal that suppliers can also check the performance of the units and quickly react to problems. “If a fridge develops a fault, they can proactively send an engineer out to the supermarket to minimize the downtime for that particular fridge,” Mr. Honan said.But that convenience opens the devices up to hacking, and leaves them vulnerable to being taken over by hackers who mean to inflict harm. France’s cybersecurity agency, CERT-FR, warned companies after last month’s hack that exposing a management interface on the internet is “contrary to good practices.” It recommended that any units that were on a public IP address be moved to a secure VPN and rebooted. It also told companies to make sure they have updated the firmware on the machines to the latest version offered by the manufacturer.There has not been any public identification of the hackers in any of the incidents and no one has claimed responsibility.Hackers are always looking for vulnerabilities in any internet exposed system. In August, the FBI issued a nationwide warning after suspected Iranian hackers targeted public water systems across seven states. The FBI and Environmental Protection Agency alerted water and wastewater utilities that hackers had been remotely accessing internet-connected control systems, changing passwords and IP addresses, and stripping operators of their ability to monitor equipment. More than 30 community water systems in Minnesota were compromised in a two-day period.“The FBI and our interagency partners are fully engaged to protect critical infrastructure, and we remain well-equipped to protect against cyber threats of all varieties,” the bureau said in a statement.It’s not just industrial-scale systems that are susceptible to hacks. Internet connected home appliances are at risk, and usually have far less security than commercial systems maintained by IT departments. Consumer TVs, stoves, and even baby monitors are able to be hacked. Security experts recommend anyone with an internet connected device to avoid using default login details and to keep the software updated.Even computer systems in cars have become targets of hacks. In September, Norwegian soldiers discovered they were being recorded through the cameras and computers in rental cars produced by a Chinese state-controlled automobile company.

From Cars to TVs: Supermarket Refrigerator Hacks Highlight Growing Risks of Connected Devices

From Cars to TVs: Supermarket Refrigerator Hacks Highlight Growing Risks of Connected Devices

More from the New York Sun

El-Sayed’s Campaign Rakes In $2.4 Million in 24 Hours After Stevens’s Endorsement of His Republican Opponent

The Road to Cormac McCarthy’s Undoing

Trump Administration Asks Supreme Court To Intervene in California Ballot Dispute One Day Before Midterm Election

Mamdani Threatens To Sue ICE, but Feds Will Keep ‘Cleaning Up’ the Streets Democrats Refuse To Protect, Agency Says

Supreme Court Orders Hillary Clinton To Respond to Trump’s Allegation of an ‘Unthinkable Plot’ Against Him

Pregnant Lexi Thompson Embraces Indoor League as a New Stage for Women’s Golf

Gruet Expectations Get a New Label

Robert F. Kennedy Jr.: ‘Criticizing Islamism Is Neither Islamophobic Nor Racist’

More from the New York Sun

El-Sayed’s Campaign Rakes In $2.4 Million in 24 Hours After Stevens’s Endorsement of His Republican Opponent

The Road to Cormac McCarthy’s Undoing

Trump Administration Asks Supreme Court To Intervene in California Ballot Dispute One Day Before Midterm Election

Mamdani Threatens To Sue ICE, but Feds Will Keep ‘Cleaning Up’ the Streets Democrats Refuse To Protect, Agency Says

Supreme Court Orders Hillary Clinton To Respond to Trump’s Allegation of an ‘Unthinkable Plot’ Against Him

Pregnant Lexi Thompson Embraces Indoor League as a New Stage for Women’s Golf

Gruet Expectations Get a New Label

Robert F. Kennedy Jr.: ‘Criticizing Islamism Is Neither Islamophobic Nor Racist’