Cyberattacks on supermarkets in European countries such as France, Belgium, Sweden, Ireland, and the Netherlands have recently caused a stir.
The aim of this attack is to spoil food items stored frozen in the stores’ refrigeration units.
Using technology from a remote location, hackers carry out attacks targeting food products. How are cyberattacks carried out by controlling freezers?
The secret of the control system
In all supermarkets that sell food products in frozen condition, machines such as refrigerators and freezers are used.
In addition, centralized control systems that operate the air conditioners installed in large stores, alarm systems for emergency alerts, and similar equipment are built in a separate area.
These control systems help technicians monitor and maintain the operation of technical equipment without having to visit each store in person.
Thus, by taking control of control systems, it is possible to regulate the overall temperature conditions of food stores and the way food is processed.
The French cybersecurity agency CERT-FR has officially announced that internet intruders have been carrying out such an act on internet-connected refrigeration units designed by the two companies Danfoss and Copeland / Dixell (Danfoss and Copeland / Dixell).
Risk of Expiration
Generally, refrigerators have a ‘defrost mode’. It helps melt and remove the ice that has hardened inside the freezer compartment.
Cyber attackers turned on the “defrost mode” inside the freezers of refrigerators in supermarkets, causing the ice to melt. As a result, food items that needed to be kept refrigerated began to spoil.
In fact, the largest refrigeration attack in France was carried out as early as last October. Hundreds of stores were affected, and the food items stored there were wasted.
On October 12 and 16, the country’s cyber security agency issued a warning related to this. Meanwhile, Danfoss and Copeland/Dixell publicly acknowledged that the control units they had sold earlier had reached the point of obsolescence.
They issued a public notice asking customers who are using older model control units they manufactured to disconnect them from the internet. They also requested that details of the new control unit not be shared online.
However, that does not put an end to the problem. Because in the intervening days, many food items left without refrigeration in the damaged freezer may spoil.
Even if the refrigerator is now run at full capacity again, whether the food items already in storage are safe remains questionable! At this point, the guidance of the U.S. Food and Drug Administration is worth noting.
It points out that whether processed food is fit to eat cannot be determined by appearance and smell alone.
Only food that is surrounded by ice crystals and remains frozen can be safely stored in the freezer.
Even if food that has not been properly refrigerated is cooked thoroughly later, there is no guarantee of safety. It has warned that eating it carries the risk of harming health.
Attacks on electricity and water
This is not the first time cyberattacks have been carried out on real-world systems. On December 23, 2015, internet intruders took control of Ukraine’s power distribution companies. As a result, power outages lasting from one to six hours occurred in Ukraine, affecting 225,000 people.
When domestic power generation companies tried to fix the outage, the internet intruders also interfered with that effort.
Then, in November 2023, the U.S. Cybersecurity and Infrastructure Security Agency accused internet intruders of controlling municipal water supplies in the United States.
Authorities brought the situation under control only by cutting off digital connections and switching to a method operated directly by humans.
India focus
For India, which has been making a strong push toward digitalization, this is a warning bell. In this context, the cyberattack carried out in November 2022 on five computer servers at Delhi’s AIIMS hospital is worth recalling. AIIMS’s online application service was disrupted for two weeks.
In India’s food trade, frozen food storage, the transport of such food items from one place to another, and their sale are all intertwined and operate like a chain.
According to information from the Food Safety and Standards Authority of India, frozen food items must be handled at minus 18 degrees Celsius or below.
Therefore, there must be assurance that the items inside the refrigeration units in shops and supermarkets are actually being stored at the temperature shown on the digital display.
Most importantly, France’s cyber security agency advises disconnecting the machines used to refrigerate food from the internet.
If this is considered impossible, then at the very least food vendors must now carefully take steps such as changing the passwords of control machines, checking whether the software tool’s configuration is correct, and replacing faulty machines.