Supermarket Cyber-Attacks Return to Haunt European Retailers

Phil Muncaster investigates what we know so far about a second wave of attacks on refrigeration control systems

For the second time in three weeks, European supermarkets are the victims of what appears to be a coordinated cyber attack. The target, yet again, is their internet-connected refrigeration systems, hijacked to turn temperatures up and deliberately spoil produce. And the consequences will be the same: reputational damage and potentially significant costs related to incident response, loss of stock, and recovery.

However, this time the impact will be felt well beyond France. And more worryingly, there are signs that attacks are also impacting healthcare supply chains.

Which countries are impacted?

So far, reports claim that supermarkets in 12 European countries including the UK have been affected. However, the impact was restricted in most to just a handful of stores, with Belgium the outlier. The roll call to date includes:

• Six Co-op stores and a “limited number” run by ICA in Sweden
• Thirteen SuperValu stores in Ireland
• A few smaller stores in the Netherlands, Germany, Italy, Portugal, Finland and Estonia
• Several meat suppliers and a fresh food wholesaler in the UK
• Dozens of Delhaize, Carrefour, Colruyt and Intermarché stores in Belgium
• Six supermarkets in Romania

As it stands, this campaign pales in comparison to the first wave of attacks, which was reported to have affected as many as 700 stores in France, causing estimated losses of tens of million of euros on the first day alone. But that’s not to underestimate its seriousness. EU food and agriculture commissioner, Christophe Hansen, has reportedly described the attacks as “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”.

“It’s a deliberate attempt to disrupt our food supply chain” Christophe Hansen

In fact, the attacks could have a further reach than that, whether deliberate or not. Reports suggest French blood banks were also among those organisations affected.

Technical details pending

A detailed technical report has yet to be compiled on this latest round of attacks, although the similarities are not hard to find. Both occurred on a Sunday night heading into Monday morning (October 11-12 and November 1-2). And in both cases, no extortion group or publicity-hungry hacktivist collective has claimed responsibility.

“This is starting to look like low-cost, deniable sabotage” Tom Hegel

“Ransomware groups usually try to get paid, and hacktivists usually want the public credit,” says SentinelOne research lead, Tom Hegel. “In this case, neither has happened which makes it start to look like the low-cost, deniable sabotage Europe has been dealing with for several years, from damaged undersea cables to warehouse arson and GPS jamming.”

Reports also point to the same targets. Although model numbers have not been shared, various outlets cited attacks accessing legacy Danfoss supervisory controllers (Estonia), as well as equipment produced by Copeland (Netherlands and Belgium), and Dixell (UK), which are now owned by the same company.

This also aligns with Forescout research which recently found almost 13,000 internet-exposed refrigeration management systems across 99 countries. It claimed that 80% of observed Danfoss AK-SM 800A StoreView services were running outdated firmware affected by known vulnerabilities. Interestingly, Forescout has also tracked 20 claimed attacks by hacktivist groups against refrigeration systems since January. The most prominent were Russia’s Z-Pentest Alliance and NoName057(16).

“Refrigeration control units feel like just the start” Caspar Rogers

Assured CISO, Nick Harris, has reviewed publicly available technical evidence from the France attacks and concludes that the culprit for initial access could be a vulnerability exploit of legacy and/or unpatched firmware. This might include a date-derived authentication bypass which was left unfixed on end-of-life equipment. Or it could simply be that hackers are searching for exposed devices on Shodan and then trying default passwords or deploying brute-force attacks.

What to look out for in a cyber insurance policy

Whatever the intrusion method, the same policy advice applies from a cyber insurance perspective. Assured senior cyber broker Caspar Rogers urges organisations to:

• Be aware that some cyber policies have a property damage exclusion which means they may not be protected for spoilage of this kind
• Look to add a spoilage/perishable goods extension to your cyber policy – this will cover the value of products that have been spoilt and loss of margin on products that couldn’t be sold
• Consider additional increased costs of working which go above the standard increased costs of working. This could enable freer spending on things like emergency cold storage, disposal of food and recovery
• Look out for narrow definitions of “computer systems” in cyber policies to ensure they affirmatively cover IoT devices like remote-controlled fridges
• Ensure waiting periods are written on a franchise basis so that once the waiting period has elapsed, business interruption cover is retrospectively applied from the moment the incident began

“While this feels specific to just retailers and meat/fresh food suppliers or producers, I wouldn’t be surprised if we start to see more of these types of incidents targeting IoT/OT machines,” Rogers concludes.

“These could result in more ‘physical property damage’-type losses. Refrigeration control units feel like just the start.”