Tom Hegel, threat researcher and research lead at cybersecurity platform SentinelOne, believes the French supermarket refrigeration cyberattack looks similar to nation-state level cyber operations aiming to disrupt and sabotage Europe. He believes we’re likely to see this kind of attack on refrigeration again as it hurts very quickly and very publicly and, as we’ve seen from so many attacks this week, retail is an incredibly easy target
“These types of attacks typically fall into three main categories: ransomware extortion, political/ideological hacktivism, or nation-state level cyber operations. Ransomware groups usually try to get paid, and hacktivists usually want the public credit. In this case, neither has happened which makes it start to look like the low-cost, deniable sabotage Europe has been dealing with for several years, from damaged undersea cables to warehouse arson and GPS jamming.
“We saw a similar pattern at US military commissaries in August, when freezers on several bases failed within a day of each other and military investigators opened cases. We can’t say the two incidents are linked. What they share is the target: refrigeration controllers that sit on the internet, often running old firmware with publicly known security vulnerabilities.
“That’s also why attribution is so hard here. An attacker who logs into an exposed control panel leaves almost nothing behind, with no malware to analyse and few clues beyond an IP address that probably leads to a rented server. A teenager and an intelligence service would look much the same from the defender’s side.
“Retail is an easy target because retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear, much of it installed by facilities contractors who rarely loop in the security team. Grocery margins are thin and stock perishes within hours, so any disruption hurts quickly and in public. The gap between a nuisance and a serious incident often comes down to how much control a victim has exposed to the internet. With thousands of these interfaces still online, I expect more incidents like this.
“Retailers don’t need to know who did it before they act. They should take these controllers off the public internet, put vendor access behind strong authentication, and replace units that no longer get security updates.
