How can cyberattacks knock out freezers?

The attacks on shops’ refrigeration systems began in France three weeks ago. By the time we get a quick chat with Fredrik Blix, Department of Computer and Systems Sciences at Stockholm University, a day has passed since Swedish Ica and Coop stores were also hit. Ever since these attacks came to light, his phone has been ringing off the hook with journalists wanting to ask questions.

Hello Fredrik, do you have time for one more interview? Tell us what’s happened!

“Of course! What’s happened is that someone has remotely changed the settings on the computers that control fridges and freezers in supermarkets. They’ve been switched from cooling to heating, and as a result a huge amount of food has been destroyed. There are reports of similar incidents in Sweden, Denmark, Finland, Estonia, Belgium, Luxembourg, the Netherlands, Ireland, Italy and Portugal, although not every case has been fully investigated. As far as we know, some 940 shops in Europe have been affected,” says Fredrik Blix.

“I haven’t been able to find a reliable total for the losses. But a single Belgian butcher says meat worth 15,000 euros has been ruined. On top of that, there are the costs of lost sales and costs of getting businesses up and running again. All in all, we’re talking about hundreds of millions of kronor,” he continues.

How were the attacks carried out?

“The computers that control the refrigeration systems are connected to the internet, which of course is handy. For instance, a technician can change the settings without having to travel to the shop. But when the computer is poorly protected, unauthorised people can get in too. There are known security flaws that have been fixed, but sometimes the updates have not been installed. Why that is, we don’t know – it could be down to cost, old equipment or unclear responsibility between the shop, the manufacturer and the service company. And a fridge can still keep food cold, even if the computer controlling it needs updating or replacing. Just because something works it’s not necessarily secure.”

But how do hackers know they can get into the freezer at a Swedish Ica?

“The information is actually available online, it’s completely open. There are companies that run search services listing internet-connected devices. That information helps those of us who work in security, but it can also be used by attackers. If a computer appears on one of those lists, it doesn’t automatically mean it can be hacked. But anyone can quickly search for every system from a particular manufacturer that has a particular flaw that can be exploited. That’s how I think this was carried out.”

Do we know who’s behind the attacks?

“No, there’s still no confirmed culprit. Nor have I found any evidence that the attacks are linked to the war in Ukraine, or to the cost-of-living protests taking place in various parts of Europe. There may be political motives, but we don’t know for sure. My view is that it doesn’t take a large organisation to pull off something like this. When lots of systems share the same weakness, even a small group can do a great deal of damage.”

What happens now? Are other businesses at risk, and what could the consequences be?

“There are many serious consequences when systems that control things like cooling, heating and ventilation are hacked. Just think of vaccines and other sensitive medicines that have to be kept refrigerated. If they get too warm, they stop working and must be thrown away. Then it’s no longer just about spoilt food; healthcare is affected. The attack has already spread beyond supermarkets: in Denmark, there have been reports of attacks on a catering firm and a biotech company, among others. The extent of the damage is not yet clear. And if, say, hospitals or care homes were targeted, the attack could quickly put people’s lives at risk.”

Have we been too keen to connect our gadgets to the internet?

“Yes, my impression is that we’ve sometimes been quicker to connect things than to protect them. Now businesses, together with their service companies, need to close security gaps, update their equipment and check that the alarms work. It’s not about switching your fridge off, but about stopping unauthorised people from controlling it!”

“I don’t think we’ll go back to doing everything by hand, but we need to be more cautious. At home, ask yourself: do I really need to be able to control this thing from the other side of the world? Turn off remote access you don’t need, install updates and ask how long the manufacturer will keep the product secure,” advises Fredrik Blix.

Den här artikeln finns också i en svensk version

Text: Åse Karlén