The latest wave of cyberattacks on fridges has claimed more victims in the UK, with a fresh food wholesaler joining the several meat processors that have been hit by hackers.
The UK’s National Cyber Security Centre (NCSC), having initially stated it was unaware of any impact on these shores, provided an update this morning to say it was “aware of a small number of UK organisations that may be affected by this incident as a result of vulnerabilities on their systems”.
Organic fruit & vegetable wholesaler Langridge Organic told The Grocer that six of its 10 cold room control systems had been hacked. Hackers were able to set the cold rooms into a defrost cycle remotely, with the maximum temperature set to 150ºF.
The intruders were also able to disable the automated messaging from the control systems that usually warns the business the cold rooms had fallen out of the necessary temperature range needed to safely store the food.
“It was amazing how many parameters they’d changed,” Langridge Organic managing director Alex Pearce told The Grocer.
“It was like kids put in front of a mixing desk: how many levers can we move to the wrong place?” he added.
Fortunately, no stock was lost as a result of the incident, since staff at the West London business perform regular, manual temperature checks.
🔔 Get breaking grocery news direct to WhatsApp
“I’m pretty sure that I interrupted a live hacking event,” Pearce said. Having spotted two fridges behaving strangely “a third unit suddenly flicks up to defrost”.
He quickly “pulled the plug out of the wall” to disconnect the fridge’s internet connection.
The attack comes after several meat suppliers reported hacking incidents on their fridge control systems this week. In all confirmed UK cases to date, the hackers have targeted fridges operated by Dixell XWEB software owned by Copeland.
The incidents are part of a fresh wave of cyberattacks that has hit supermarket fridges across Europe, including in Ireland, Sweden, Belgium, Estonia, the Netherlands and Luxembourg.
The latest wave follows a similar one in France last month, in which hackers commandeered the fridge and freezer systems at hundreds of French supermarkets – including Carrefour, Intermarché, Netto, Coopérative U and Monoprix – remotely raising their temperature. This led to spoilt food and in some cases, fires.
It is understood the web login page to those fridges’ built-in computers – known as controllers – which are used by engineers to check temperatures and tweak settings, were readily found by hackers on the open internet, rather than being hidden and reachable only via a private, protected connection.
Vulnerabilities in these login pages meant hackers were able to access the fridges’ controllers, and adjust settings remotely.
While software updates to repair these known vulnerabilities – known as patches – had been issued, these had not been implemented by the retailers.
Pearce told The Grocer that updating his cool room systems’ cyber security was something the business had “never thought about”.
“Even, weirdly, when I heard about the French attacks, it didn’t make me think particularly we would be at risk, because I assumed it was a bit more targeted,” he said.
“But I don’t think they’re even aware who we are. I think they simply had the ability to see our control panel and therefore had a twizzle on it.”
The NCSC told The Grocer “we stand ready to assist” any UK businesses that have been impacted, and that it continues to “liaise with our international partners and the affected sectors to understand and mitigate its impact”.
Pearce described it as an “interesting start to a Monday morning” and “one way at 5:30am to get the blood pumping”.
No comments yet