As widely reported across the media in recent weeks, fridges and freezers in stores across Europe have been the victims of hacks which saw their temperatures altered, leading to tonnes of food being thrown away.
Put broadly, these defrosting attacks centre on stores’ machines that are externally controlled online, leaving them open to hacking and the resulting piles of stock that then cannot be eaten.
Stores in Belgium. Sweden, Ireland, the Netherlands, Estonia and Finland were all attacked earlier this week, and the National Cyber Security Centre (NCSC) has now confirmed to the BBC that fridges and freezers in UK stores were also being affected by the attacks, saying it was aware of “a couple of incidences” of the tech failing.
No confirmation
So far, there hasn’t been any confirmation of anything affecting the convenience sector - which most likely stems from the fact smaller stores wouldn’t use external methods to control the temperatures of their chillers or freezers.
However, there could be concern that larger stores may fall victim to attacks, with symbol groups, smaller supermarkets and any premises where tech is at the storefront may still be liable. In addition, there is nothing to say other externally controlled aspects of retail might not be affected, such as payments, CCTV, operating systems and more.
Other issues
In response to the recent news, Andrew Goodacre, CEO of the British Independent Retailer Associaiton (Bira), said: “This time it was freezers, but tomorrow it could be your EPOS system, your card machines or your website.
“Anything in a shop that connects to the internet is a potential way in…”
“Anything in a shop that connects to the internet is a potential way in, and that includes equipment many retailers would never think of as IT, such as refrigeration controls, CCTV and alarm systems.”
When approached by Convenience Store for comment, a Go Local representative said that while the chain had not been affected, it had systems in place to cope in the event of an attack, but would not share details for security reasons.
Other retail groups confirmed to Convenience Store that they had not been affected.
Tech response
The tech industry was quicker to comment. Dai Vaughan, chief technology officer at consultancy Public Digital, said: “Cyber attacks don’t have to bring down computer systems to cause serious damage. As these supermarket attacks show, something as simple as changing the temperature of a freezer can destroy thousands of pounds worth of stock.
“More and more of the equipment we rely on is now connected to the internet, from supermarket fridges to heating systems and factory machinery. That makes it easier to manage, but it also creates new risks if security isn’t properly considered and maintained. The security of these systems has to keep pace with how much we rely on them.”
Also commenting, Samuel Hassine, CEO and co-founder of threat management platform. Filigran, said: “A fridge is now a computer and these attacks prove it. The method that hit French supermarkets last month has now reached shops in seven other European countries.
“Freezers warmed overnight and food had to be thrown away. Many of these controllers sit openly on the internet, and some need physical changes, not just a software update. The response has been quick. Technicians worked through the night to disconnect units, and national agencies are working together.”
Security advice
Finally, Jamie Akhtar, CEO and co-founder of tech company CyberSmart, offered some words of advice: “It highlights how vulnerabilities in connected technology can cause serious disruption to everyday operations, resulting in significant financial losses, damaged equipment and potential risks to public safety. As more businesses rely on internet-connected systems, the opportunities for cyber criminals to cause real-world damage are increasing.
“Organisations should ensure software and firmware are regularly updated, implement strong access controls and separate operational technology from wider business networks to limit potential attacks.
“Regular security assessments and continuous monitoring can also help identify vulnerabilities and suspicious activity before they cause significant disruption. Businesses should also have robust incident response and continuity plans in place to minimise the impact if critical systems are compromised.”
No comments yet