A threat that until recently might have seemed like something out of a science-fiction scenario has become a reality in Europe. Hackers have breached the cooling systems of hundreds of stores, causing fires and economic losses amounting to millions of euros.
An investigation published by Al Jazeera shows that supermarket refrigeration systems were attacked twice within less than a month. The cases have raised serious questions about the security of internet-connected devices.
Të lidhura
None found
The incidents show that cyberattacks are no longer focused solely on computers, phones or financial institutions. Everyday devices such as smart refrigerators, televisions and robot vacuum cleaners can be used as entry points for larger-scale attacks.
On October 11 and 12, attackers took control of cooling systems in around 700 stores in France. Temperatures inside the units rose to 50 degrees Celsius, damaging food products and causing fires in some supermarkets.
Another suspected wave of cyberattacks was detected on November 2. This time, supermarkets and food businesses in at least nine European countries were affected: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden.
French authorities have linked the first attack to the Shahid Kaveh cyber unit, which is associated with Iran’s Islamic Revolutionary Guard Corps. The perpetrators of the second attack have not yet been officially identified.
In many supermarkets, refrigeration equipment is managed through a central control panel. The panel is connected to the internet so technicians and maintenance companies can manage the systems remotely.
Attackers exploited this internet connection to interfere with the equipment’s operation.
Vincent Strubel, head of France’s National Cybersecurity Agency, ANSSI, said the attacks were made possible by several basic security weaknesses.
The devices were directly accessible from the internet and lacked additional security measures. In some cases, weak passwords or factory-set credentials were used, while some systems were older models that no longer received security updates.
Once inside the network, hackers could change temperatures, turn off refrigerators or otherwise interfere with their operation. In France, they used the defrost function to raise the temperature of the equipment.
The risk is even greater because the same types of technology are used in fields where the consequences of interference could be far more serious.
During a hearing in the French Senate on October 21, the head of ANSSI warned that similar devices are found in hospitals, pharmacies and research laboratories, where they are used to store vaccines and hazardous materials.
An attack on these systems could have far more serious consequences than food spoiling in a supermarket.
According to Al Jazeera, similar vulnerabilities could also be exploited against critical infrastructure, including power plants, water supply systems, banks and hospitals.
In July, a cyberattack in Minnesota, US, targeted more than 30 community water supply systems. Also that month, a small power plant in Britain was forced to shut down for four days after an attack attributed to hackers linked to Iran.
The problem is not limited to companies and institutions. Smart devices used every day at home can also become targets of attacks.
Data cited by Al Jazeera show that around the world there are about 21 billion devices connected through short-range networks and 5.4 billion devices that communicate over long distances.
Routers can be manipulated to direct users to fake websites and steal their passwords.
Some apps on smart TVs can be secretly used to exploit a household’s internet connection.
Vulnerabilities in robot vacuum cleaners can expose cameras, microphones and maps of the interiors of homes.
Interfering with smart refrigerators can disrupt their operation and also pose a risk to the network they are connected to.
Another case was reported this year in which a programmer took control of nearly 7,000 DJI Romo robot vacuum cleaners. Through them, he could view camera footage, listen to audio and access maps of homes.
Experts advise replacing default passwords with strong, unique ones.
Devices and apps should be updated regularly, while unnecessary features, especially remote access, should be disabled.
Older devices that no longer receive security updates should not be left connected to the network. Routers should also be secured, and all available security mechanisms enabled.
Awais Rashid, a professor of cybersecurity at the University of Bristol, warns that the growing digitization of infrastructure brings an increasing risk of disruptions caused by cyberattacks.
