Key Takeaways
- The European supermarket refrigeration attacks demonstrate how attackers can create costly physical consequences without ever crossing a physical perimeter.
- The attacks exploited basic vulnerabilities rather than utilizing sophisticated techniques, highlighting how poor cyber hygiene and outdated connected systems continue to create significant organizational risk.
- Effective property protection now requires collaboration between physical security, cybersecurity, and operational technology teams, as modern threats increasingly cross traditional functional boundaries.
Locks, alarms, and oversight are vital to protecting property, but recent attacks on supermarkets across Europe serve as a reminder that not every threat enters through a door, gate, or perimeter.
From big chains to local markets, hackers effectively turned internet-connected refrigeration and freezer systems into heaters. A butcher shop owner in Athens said someone turned up the temperature of a refrigeration unit in his store to 150 degrees Celsius (302 degrees Fahrenheit), taking a technician two hours to regain control of the system. Some 700 supermarkets in France were hit in the first wave of attacks.
The economic toll is still being tallied, but loss estimates are in the tens of millions of euros from food spoilage, equipment fires, and operational disruptions. Nor are the risks purely financial. French authorities reported that cyberattacks also targeted refrigeration systems in medical facilities used to store donated blood.
“Attacking equipment that is essential to the preservation of fresh products and the food supply of the French people is extremely serious and unprecedented. It is unacceptable,” wrote Dominique Schelcher, CEO at Cooperative U, which had close to 100 stores impacted.
An Expanding Attack Surface
Speculation on the culprits behind the attacks was particularly telling. Cybersecurity and intelligence officials variously pointed the finger at everyone from Russian hacktivist groups and Iranian operatives to technologically adept teenagers. Such a wide range of plausible perpetrators underscores a troubling reality: the attack surface is expanding while the expertise and resources required to exploit it are widely accessible.
There is no evidence that AI played a role in the attacks, underscoring how much damage can result from a simple exploitation of poorly secured physical systems connected to the Internet. Rather than relying on sophisticated zero-day exploits, attackers reportedly took advantage of outdated products that no longer received security updates and systems still protected by default passwords. "The cyberattack on French supermarkets was a result of exploitation of known vulnerabilities," U.K. cyber minister Liz Lloyd said in a speech. "It's a clear demonstration that poor cyber hygiene, like weak passwords, continues to put organizations at risk."
...A wide range of plausible perpetrators underscores a troubling reality: the attack surface is expanding while the expertise and resources required to exploit it are widely accessible.
As legacy infrastructure systems are connected to broader networks and migrated to cloud-based platforms, they are increasingly exposed to cybercriminals seeking ransom payments as well as activist groups and nation states pursuing political objectives. Meanwhile, many organizations are racing to adopt AI and other advanced technologies while failing to address basic vulnerabilities in the systems they rely on every day, like ordering systems and building controls, according to Nicole Carignan, senior vice president of security and AI strategy at cybersecurity company Darktrace.
"Organizations are pouring budget into AI and digital transformation while the systems that keep food cold, water clean, and lights on often run on hardware that has not been funded since installation," she told PBS (“Here's what to know about another cyberattack on European supermarket fridges,” PBS, Nov. 3).
Property Protection Must Consider Hybrid Threats
The growing interconnectedness of systems has increased the risk of converged security incidents, such as unauthorized physical access that facilitates cyber intrusion or remote network attacks that create physical consequences, as in the recent supermarket freezer attacks.
Security is further complicated by the powerful business case for connectivity. From automation and remote monitoring to cost reduction and operational efficiency, connected systems create tangible benefits that encourage rapid adoption, sometimes before the necessary security controls are in place. For supermarkets, connected freezers make it possible to constantly monitor temperatures across an entire chain, reducing food spoilage and energy use while enabling remote diagnosis and fixing of equipment issues. Most businesses can find similar value from connectedness, through automation, greater productivity, enhanced capabilities, or lower costs. Businesses can also use connectivity as a competitive differentiator, fueling even more rapid adoption.
While there are countless benefits to aggregating and analyzing data from multiple endpoints, every additional connection between field devices, network data centers, and Internet-connected systems expands the attack surface. With connected systems, a company’s security perimeter extends to devices operating outside of secured locations and may link to its critical systems. Connectivity highlights the fact that defense-related activities are linked, with each representing a link in a chain. And like any chain, it is only as strong as its weakest link.
...It never crosses their mind they actually are running OT systems that are interlinked with, and even partly consist of, IT equipment.
Securing operational technology (OT) — control equipment that influences the real world — is further complicated by the fact that it has traditionally been managed by operational departments, according to Dr. Johan J. de Wit, a researcher at Delft University of Technology in the Netherlands and Enterprise Security Strategist for Siemens Building Technologies. These individuals are responsible for keeping organizational processes running with a focus on system availability and reducing downtime, and have traditionally managed automation systems that were not connected to the outside world. As de Wit observes:
“They are still of the opinion they are running an operational technology (a powerplant/production process/ bridge/building, etc.) and it never crosses their mind they actually are running OT systems that are interlinked with, and even partly consist of, IT equipment,” de Wit writes in Cyber-Physical Security and Critical Infrastructure.
Meanwhile, IT departments are usually focused on office IT, may be completely unaware of OT systems in their network, or may not understand or accept that OT systems have some peculiar characteristics that require special management, said de Wit. And regarding physical security of OT systems, de Wit characterizes it as “still in its infancy.” Ultimately, real security requires a teamwork approach that includes all aspects, physical, IT and OT.
A Path Towards Protection
Security threats today aren’t cyber or physical—they’re both. And, just as often, countermeasures aren’t one or the other. But this convergence hasn’t spurred a great revolution in how security is managed.
As de Wit notes, silos of security responsibility are a primary cause of unrecognized vulnerability and unmitigated threats. While connected systems provide motivated attackers with the means to conduct hybrid attacks, siloed security functions provide the opportunity: vulnerabilities and gaps in security emerge when physical and cybersecurity are managed in isolation from one another.
Collaboration is imperative at all businesses, and especially within critical infrastructure facilities, where there is typically a complicated division of responsibility for different aspects of protection. As the threat surface expands and threats increasingly overlap, a purely functional approach to security may no longer be sufficient.
To arrive at an appropriate security response considering the risks, businesses need to be inclusive and strategic in their approach, according to Felipe Bayon, CEO of Ecopetrol Group, Colombia's leading energy company which operates pipelines, refineries, and transmission lines across the Americas. Speaking at the World Economic Forum, he said a willingness to conduct an honest self-assessment is a critical first step, noting that when they took a hard look at their security posture against the current risk environment, they understood they needed to do more.
Ecopetrol began the effort by engaging a broad range of stakeholders, including at the board level. “We realized we needed to step it up and raise our game,” he told the Davos audience. “We said we need to have at least three or four years of a program that is very comprehensive.”
A collective defense approach capable of meeting security needs in a connected age requires recognition that security is truly a shared responsibility between many stakeholders. One group may have responsibility for protecting employees and visitors, while another conducts facility management, and another conducts patrols, investigates offenses, and responds to incidents.
The supermarket attacks demonstrate that modern threats do not respect organizational charts or functional boundaries. A vulnerability in an operational system can become a cybersecurity incident, a business continuity challenge, and a physical security problem simultaneously. Organizations that continue to manage these risks in isolation may find their greatest vulnerabilities lie not within a facility's walls, but in the gaps between traditionally separate security functions.
In an era when an attacker can compromise physical assets without ever crossing a perimeter, effective property protection depends on a coordinated approach that brings physical security, cybersecurity, and operational teams together.