A recent wave of cyberattacks targeting internet-connected refrigerators, impacting everything from blood banks in France to supermarkets across Europe, serves as a critical reminder that basic cybersecurity hygiene remains paramount in protecting vital infrastructure.
The attacks, which saw temperatures in cold storage facilities spike, fortunately did not result in the spoilage of blood samples at France's Établissement Français du Sang (EFS), thanks to quick detection and intervention. However, similar incidents have led to massive food waste in supermarkets across at least 11 European countries, as well as affecting commissaries on US military bases.
Experts like Josh Corman, a critical infrastructure researcher, lament that our reliance on connected technology is outpacing our commitment to securing it, leaving us vulnerable. "These fragile cold-chain systems are too critical to fail, but we keep experiencing hard lessons," he stated.
While the perpetrators remain unidentified and the attacks' connectivity is unconfirmed, initial investigations suggest vulnerabilities in refrigeration controllers, particularly those from Danish firm Danfoss, were exploited. Many of these systems were reportedly running outdated firmware and using weak passwords, making them easy targets for authentication bypasses and other exploits, according to the US Cybersecurity and Infrastructure Security Agency.
Attribution is murky, with Russian hacktivists claiming responsibility without concrete proof, while some researchers point to Russia-based or Iran-linked actors. Similar attacks have occurred previously, including targeting supermarkets in Russia and Israel in 2022.
Sweden's National Cyber Security Center advises businesses to inventory their connected devices, disconnect them when feasible, and ensure any necessary connections are secured, patched, and monitored to prevent future incidents.
