TORONTO - For the second time in less than a month, supermarkets across Europe are tossing out spoiled food after hackers took control of their refrigeration systems overnight, sending temperatures in freezers as high as 50 C.
No similar incidents have been reported in Canada, but cybersecurity expert Ritesh Kotak believes some Canadian stores could be vulnerable.
“If these controllers are embedded within refrigeration or just any type of equipment, and the vulnerability probably exists within Canada as well, then yes, in theory, hackers would be able to take over and control everything from the temperature to any type of sensors,” Kotak told CTV News.
Many of the hacked systems were made by Danish company Danfoss, which sells products in Canada. It is not known which Canadian grocers, if any, use the affected systems.
Canadian grocery retailers are watching the situation, though Metro Inc. declined to discuss its cybersecurity.
Stephanie Bonk, a communications manager at Metro, said in an email. “We do not publicly discuss our cybersecurity practices or controls. Accordingly, we have no comment regarding this matter.”
Canada has already seen hackers tamper with other kinds of equipment. Just last year, the Canadian Centre for Cyber Security warned that hacktivists, hackers driven by political or social causes, are increasingly exploiting internet-connected industrial systems. The centre, along with the RCMP, has received multiple reports, including one where water pressure was tampered with at a water facility, and another where a grain-drying silo on a farm had its temperature and humidity manipulated.
Several countries hit
The attacks on Monday are believed to have hit stores in seven European countries, including Belgium, Sweden and Ireland. They follow an attack in France three weeks ago, when hackers gained control of cooling units at hundreds of supermarkets causing millions of dollars worth of food losses.
In many large grocery stores, every fridge and freezer is linked to a control unit that sets temperatures, runs defrost cycles and raises alarms. Those control units can often be reached over the internet so maintenance firms can manage them remotely.
Once inside, Kotak said, hackers can do real damage. “You can turn up the temperature. You can turn down the temperature,” he said. “You can continuously make the temperature in flux, going up and down.” He said that can burn out equipment or spoil food that must be kept at a set temperature.
In France, most of the hacked Danfoss controllers were older models that no longer received security updates. Investigators have not said exactly how the attackers got in.
“We always knew that any time something is connected to the internet, there’s a very strong possibility that it could be misused by bad actors, and unfortunately, we’re seeing that,” Kotak said.
Who is behind it?
So far, there are no reports of anyone claiming responsibility or making a ransom demand. Kotak said that points to motives beyond money.
“In some cases, it could be ideological. It could be state-sponsored, and the whole idea behind that is that it causes disruption,” he said.
“If you go into a grocery store and there’s nothing in the fridges, that’s going to worry people,” he added.
Since Russia’s 2022 invasion of Ukraine, there have been growing fears in Europe of sabotage and cyberattacks linked to Moscow, which denies any involvement.
Meanwhile, the U.S. Defense Department has confirmed it is investigating freezer failures at military commissaries in August, that resembled the European attacks. At least six locations were affected, and four officials told Reuters that the Pentagon is treating them as a suspected hack.
At Fort Huachuca in Arizona, the base posted on Facebook on Aug. 26 that an overnight equipment failure at its commissary sent all the freezers into defrost mode, spoiling the frozen food. Coolers holding produce and other items were also knocked offline.
There is no evidence artificial intelligence was used in any of the attacks, but Kotak said it could help hackers quickly exploit unpatched systems. He warns that “these cyberattacks are going to become much more frequent.”
His advice to businesses is to ensure they can keep operating if their systems must go offline. “Go on the assumption that these types of attacks are going to happen to your systems,” he said.
With files from Reuters
