Hacked refrigerators: the fragility of a society every day more connected

BarcelonaOn the night of October 11 to 12, attackers took remote control of the systems regulating refrigeration in some 700 supermarkets and shops in France. They did not steal data or demand a ransom: they only activated the defrost function of the appliances and extended it so the chambers would heat up. The president of the Intermarché chain acknowledged that it reached 50 °C. According to the French government, there were at least 15 attempted fires and food worth tens of millions of euros was ruined.

Three weeks later, between November 1 and 2, another attack of the same type occurred, this time affecting more than a hundred stores in Belgium, Sweden, Ireland, Estonia, and the United Kingdom. In London, the owner of a fruit and vegetable wholesaler explained to The Guardian that upon seeing the defrost lights on his refrigerators turned on, he pulled the internet cable from the device controlling them. That same night, the plasma chambers at three centers of the Établissement Français du Sang (EFS), the organization that manages blood donation in France, were also attacked; fortunately, the alarms detected it in time and, according to the EFS, no product was lost. The attack had not entered through their systems, but through those of the refrigeration installer.

In all cases, the attacked devices are commercial refrigeration controllers, which are connected to the internet to be monitored remotely without having to go there. Ten days after the first incident, the director of the French cybersecurity agency (ANSSI) already summarized the reasons: the equipment was directly exposed to the internet, without special protection and with weak passwords. For its part, the United Kingdom's National Cyber Security Centre (NCSC) stressed this by ensuring that the default passwords appeared in the manuals of one of the companies in the sector. The Danish manufacturer Danfoss justified itself by saying that many of the affected devices were old and no longer received updates.

The hypothesis of authorship

This same week, the French Ministry of Foreign Affairs has attributed the October wave to Iran: specifically to Shahid Kaveh, a unit of the Islamic Revolutionary Guard Corps. France provides no conclusive proof, but speaks of a set of indications, such as infrastructure shared with other operations or the use of Farsi. As expected, Tehran denies everything.

According to an expert from the firm Sophos, hostile operations against the West usually come from the quartet formed by China, Russia, Iran, and North Korea, with different objectives: China seeks industrial espionage and mass data; Russia, to disrupt infrastructure and spread disinformation; North Korea, to hack cryptocurrency platforms because it needs money. And Iran wants to send a warning to its enemies.

The attribution to Iran by the French government only covers the October wave. The one in November was claimed by pro-Russian groups, but without providing evidence, although some specialists see tactics typical of groups from that country. On the other hand, the Sophos expert asserts that the two waves are linked. Be that as it may, the Belgian cybersecurity agency has acknowledged that it may never be known who the author was.

It is not the first time

The most common cyberattacks continue to be those that affect computer systems and the data they contain, and disrupt the commercial, industrial, or administrative activity of victims, such as service companies or health facilities. Unlike the refrigerators, the motives are usually economic: the perpetrators seek to obtain money. In May 2021, the ransomware (software that encrypts data and demands a ransom) from the DarkSide group shut down the Colonial pipeline in the US for a week. WannaCry, which the governments of the United Kingdom and the USA attributed to North Korea, affected a significant part of the British public health system in 2017. In Spain, that attack affected Telefónica; I witnessed how the operator's cybersecurity director learned of the incident upon finishing a presentation on their cyberdefense capabilities at the Barcelona Motor Show. In June of the same year, the NotPetya cyberattack, attributed to Russia, forced Maersk to shut down the container terminal it has at the port of Barcelona.

The case of the European refrigerators is more similar to that of the gas stations in Iran, where the card payment system was put out of service in 2021 and 2023 by attacks from the Predatory Sparrow group, which the press links to Israel. In those two cases, no ransom was demanded.

The novelty is that the most recent waves of sabotage now directly affect physical systems and equipment, with more visible effects that accentuate citizens' perception of insecurity: it is not the same for a doctor not to be able to access your medical records as it is to see how the supermarket where you shop every week has had all its yogurts, sea bass, and steaks spoiled.

AI: accelerator and excuse

Everything points to the fact that artificial intelligence (AI) will further increase common cyberattacks and could also make those affecting physical equipment cheaper. The director of the NCSC considers that we are at the dawn of a new level of threat and that a large increase in the number of incidents is to be expected. The organization has warned that it is very likely that in 2028 malicious software with AI will be used against British power plants, airports, and hospitals. However, in the case of refrigerators, he also acknowledged that the attackers did not need AI at all.

With or without AI, the attacks show how a part of digitalization has been built: with everyday devices connected to the internet for convenience, often without maintenance and with remote access in the hands of a third party. Keeping devices secure also costs money, and some authorities have already hinted that consumers will have to accept paying more for robust and updated products.

Insurance adds a nuance to this. According to Reuters, the losses of French supermarkets, in the tens of millions of euros, may not be covered by cyber policies, which usually exclude physical damage. If the attack ends up being attributed to a state, insurers could invoke the exclusions for war or state-sponsored attacks, which Lloyd's has required in cyber policies since 2023, according to Insurance Journal, although for the moment there is no record of any insurer having done so.

In any case, the defense that saved the plasma stored at the EFS was not sophisticated at all: alarms that went off in time, a plan to move the products, and the presence of an on-call technician to implement it. Looking to the future, it might be worth keeping in mind what The Guardian explains: the vegetable wholesaler in London still hasn't plugged back in the internet cable for their freezers, claiming that their business continued to function normally.