How supermarkets became targets of cyberattacks, Pg13

Key Highlights:

• Supermarket refrigeration systems across France and nine other European countries were targeted by cyberattacks in October.
• The attacks caused refrigeration units to run at 50 degrees Celsius, spoiling food and emptying shelves.
• Unlike typical cyberattacks, no ransom was demanded, nor was any customer data stolen, indicating a motive of disruption rather than profit.
• Systems from Danish engineering firm Danfoss were reportedly targeted, exploiting vulnerabilities in older software and internet-connected controllers.
• The incident highlights the vulnerability of supply chains and the need to redefine critical infrastructure to include essential services like food retail.

Cyberattack.jpg

Detailed Insights:

• The cyberattacks affected major supermarket chains including Intermarche, Carrefour, Spar, and Delhaize, as well as some Ikea restaurants.
• The attackers exploited the "forced defrost" function in central controllers, extending the defrost cycle and raising temperatures.
• Many modern refrigeration controllers are connected to the internet for remote maintenance, creating a significant security vulnerability.
• Older control systems, designed for reliability rather than internet security, often remain in service for decades, outliving software support cycles.
• Researchers had disclosed vulnerabilities in Danfoss web interfaces in August, two months prior to the attacks, particularly in units running older software.
• The incident underscores that the objective was likely to test societal resilience by disrupting everyday supply chains and causing public anxiety.
• For countries like India, with growing Internet of Things (IoT) adoption in retail, assessing the security of remote links to controllers is crucial.
• Recommended fixes include promptly patching controllers, replacing unsupported systems, taking critical hardware off the public internet, and securing remote access with VPNs and Multi-Factor Authentication (MFA).
• Regulators are urged to consider mandatory security standards for operational technology in food retail, similar to other critical sectors.

Key Concepts Involved:

• Critical Infrastructure: Systems and assets vital to a country's functioning, whose incapacitation would have a debilitating effect on security, national economic security, national public health or safety.
• Internet of Things (IoT): A network of physical objects embedded with sensors, software, and other technologies for connecting and exchanging data over the internet.
• Ransomware: A type of malicious software that encrypts a victim's files, demanding a payment (ransom) to restore access.
• Multi-Factor Authentication (MFA): A security system that requires more than one method of authentication from independent categories of credentials to verify the user's identity.