10
Loading video...
By Joe Edwards
Reporter
0
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
Widespread suspected cyberattacks targeting European supermarket freezers have raised questions about whether a comparable event could unfold in the U.S.
Following an incident in France last month, in which authorities said refrigeration units at hundreds of supermarkets were hijacked, causing food losses and even fires, suspected cyberattacks involving sudden increases in freezer temperatures were reported in several other European countries, including Belgium, Sweden, Ireland, Estonia, the Netherlands and Luxembourg.
The Pentagon has also been investigating a string of freezer malfunctions at U.S. military bases in August as suspected cyberattacks. A spokesperson for the Army Criminal Investigation Division told Newsweek it was working to understand the incidents in the U.S. and Europe with other government agencies and French law enforcement.
Read More on News
As of publication, officials had not identified those responsible for the European hacks.
Could U.S. Supermarkets Face Similar Attacks?
“U.S. supermarkets should absolutely be paying attention to what is happening in Europe,” Sean Tufts, field chief technology officer of cybersecurity firm Claroty, told Newsweek.
“The same types of refrigeration controllers are used across the food retail industry, and many use remote connections so technicians can monitor equipment and make repairs without visiting every store. When those connections aren’t properly secured, they can give attackers a way to interfere with systems that grocery stores depend on every day.”
Tufts said refrigeration controllers are not limited to food storage but are also used by hospitals, pharmaceutical companies, water utilities and data centers. “Essentially, any organization that handles temperature-sensitive goods is at risk and must take action to protect itself from a similar attack.”
He warned that if an attacker takes control of a refrigeration controller, they could cause serious operational disruption and significant financial losses simply by altering the temperature setting or activating a defrost cycle.
“The good news is that supermarkets have practical ways to reduce their exposure now,” said Tufts. “They have to start by asking the basic question that often gets overlooked: Do you know which refrigeration controllers are connected to the internet and who can access them?”
...
Tufts said grocery operators should check with any third-party contractors that refrigeration equipment is not unnecessarily exposed to the public internet. He recommended securing essential remote access with strong authentication, reviewing default passwords, updating supported equipment and segmenting critical systems to limit the effects of a breach.
“True cyber resilience means getting ahead of risks by understanding where your systems are exposed before attackers do,” Tufts added. “Acting only after the ice cream melts and the food waste piles up is too late, and is a consequence the food supply chain can’t continue to bear.”
A Large Coordinated Attack May Be Less Likely
Daniel Ward, an IT and cybersecurity expert and professor at Southern New Hampshire University, told Newsweek the risk depends on whether supermarket chains connect their refrigeration systems to a network and adequately secure and isolate access to them.
“However, the perspective is often the same as similar devices that power manufacturing environments and the nation’s critical infrastructure. These devices were often not produced with security in mind, and they typically do not receive updates to help fix security vulnerabilities.”
Related Story
Map Shows Countries Hit by Supermarket Freezer Cyberattacks
Ward said that although there has been a major effort over the past decade to increase awareness of device vulnerabilities in manufacturing and critical infrastructure, related sectors such as refrigeration manufacturing “have not been considered in the discussions at large.”
“With all this being said, I do believe the overall risk of a coordinated attack at scale is relatively low, considering the time and resources necessary to pull off an attack of any significant scale. I think it is more likely that we see issues like the recent Iran attacks on water infrastructure, where devices that are directly connected and accessible to the internet become low-hanging fruit for attackers looking to make a quick impact.
“The threat of AI agents being able to coordinate a larger-scale attack is also present, however, whether it is human actors or AI agents, there are still the same limitations present where significant resources (time, opportunity, information) are necessary to drive a large-scale attack.
...
Chris Butera, acting executive assistant director of the Cybersecurity and Infrastructure Security Agency’s Cybersecurity Division, told Newsweek the agency and its government, industry and international partners were actively monitoring and assessing malicious cyber activity targeting refrigeration and cold-chain monitoring systems.
Newsweek also reached out to several major U.S. retailers for comment on Wednesday.
Related Story
Cyberattacks Target French Blood Banks After Supermarkets Hit
Contact Newsweek editors on this story: Tobias Meyjes, Gray R. Thomas
View 0 Comments
Submit Correction
View Editorial & AI Guidelines