A mass hack targeting refrigeration controllers has reportedly cost affected businesses tens or even hundreds of millions of euros, highlighting significant lapses in cybersecurity practices. The incident, which impacted supermarkets across Spain, Portugal, Poland, Germany, and Belgium, was attributed to outdated firmware and a lack of basic security measures, such as VPNs and restricted IP access, according to researchers from Pen Test Partners.
The researchers emphasized that simple cybersecurity hygiene could have mitigated the breach. They noted that taking the controllers off the public internet, implementing remote access through a VPN, and maintaining a documented approach to third-party equipment would have significantly altered the outcome. “Cyber hygiene would have prevented the access,” they stated, underscoring the importance of changing default credentials and keeping systems updated.
This incident follows earlier warnings from security firm Claroty and the U.S. Cybersecurity and Infrastructure Security Agency (CISA), which highlighted vulnerabilities in similar refrigeration systems. In a recent communication, Danfoss, the manufacturer of the affected controllers, acknowledged a vulnerability in an end-of-life generation of their products and stated they are working with customers to prevent future incidents. However, the company did not respond to inquiries regarding the specifics of the attack.
The identity of the attackers remains unknown, leading to speculation about the motives behind the hack. While some experts suggest it could be an act of vandalism, others consider the possibility of a nation-state or international actor aiming for widespread disruption across Europe.
This incident illustrates the ongoing struggle between financial considerations and cybersecurity investments within organizations. Many businesses hesitate to allocate substantial funds for security upgrades until they experience a significant breach, often realizing too late the value of such investments. As executives at the affected supermarket chains grapple with the fallout, it remains uncertain whether this cautionary tale will prompt broader changes in cybersecurity practices across the industry.
For further details on the vulnerabilities and security implications, refer to Ars Technica.
